Avi Rubin: My Experience As An Election Judge

It is now 10:30 pm, and I have been up since 5 a.m. this morning. Today, I served as an election judge in the primary election, and I am writing down my experience now, despite being extremely tired, as everything is fresh in my mind, and this was one of the most incredible days in my life.

I first became embroiled in the current national debate on evoting security when Dan Wallach of Rice University and I, along with Computer Scientist Yoshi Kohno and my Ph.D. student Adam Stubblefield released a report analyzing the software in Diebold's Accuvote voting machines.

Although there were four of us on the project, perhaps because I was the most senior of the group, the report became widely associate with me, and people began referring to it as the "Hopkins report" or even in some cases the "Rubin report". I became the target of much criticism from Maryland and Georgia election officials who were deeply committed to these machines, and of course, of the vendor. The biggest criticism that I received was that I am an academic scientist and that academics do not "know siccum" about elections, as Doug Lewis from the Election Center put very eloquently.

While I dispute many of the claims that computer scientists working on e-voting security analysis are deficient in their knowledge of elections, I realized that there was only one way to stifle this criticism, and at the same time to perform a civic duty. I volunteered to become an election judge in Baltimore County. The first step was to get signed up. I filled out a form at a local grocery store and waited for a call from the Baltimore County Board of Elections. The call never came. So, I called up the board and spoke with the head of elections and found out that there was a mandatory training session a couple of days later. I got on to the list for the training, and I attended. There, I learned that my entire county would be voting with Diebold Accuvote TS machines, the very one that we had analyzed in our report. It was an eery feeling as I trained for 2 hours on every aspect of using the machine and teaching others how to use them. Afterwards, I received a certificate signed by the board of elections and became a qualified judge. I was supposed to receive a phone call within a few days assigning me to a precinct, but I did not. So, I called up the board of elections and spoke with the same woman, who assigned me to a precinct at a church in Timonium, MD, about 15 minutes from my house.

I reported to my precinct at 5:45 a.m. this morning. Introductions began, and I immediately realized that it would not be a normal day. There are two head judges, one from each party. There were also seven other judges. The head judges were Marie (R) and Jim (D). Both of them mentioned that they read about me in the paper that morning, and were pretty cold towards me. It turns out that the Baltimore Sun ran a story today about my being an election judge. In there, I'm quoted as saying that the other judges in my training were in the "grandparent category" with respect to their age. My colleagues for the day, who were in that category as well, did not appreciate the barb and were ready to spar with me.

There are three types of judges besides the head judges. There are four book judges, one from each party with A-K and one from each party with L-Z. There is one judge assigned to provisional ballots, and a couple of unit judges charged with assigning voters to particular machines. I was the L-Z democrat book judge, along with Andy, a grandfather of many, a staunch Republican, and a fellow I grew very fond of as the day went on. To my left were Anne, the Republican judge married to Andy, and Sandy. Actually, there were two Sandys. One began as a unit judge, but early on switched with the other Sandy to be the democratic book judge on A-K. Bill was the provisional judge, and he is married to head judge Marie. And then there was Joy. One of the Sandys, Joy and I were the three younger judges who did not fit into the grandparent category.

Joy was by far the most knowledgeable about the election. She had trained dozens of groups on the Diebold machine, and she knew all of the procedures inside and out. The head judges deferred to Joy on just about every major issue that came up. She knew our manuals by heart, and we were very lucky to have her there. In reality, all of us helped with all of the jobs, but we had our default assignments.

The job of the book judge is to look up each voter in a card deck and find their registration card. If there wasn't one, then there were procedures for handling them. Once we found the card, we cross checked it with our roll booklet. For the most part this process went smoothly. I wore a string around my neck with a little electronic sleeve on the end. After a voter was verified as registered, I slid a smartcard into the sleave and pushed a few buttons to designate whether or not this voter should receive a Democrat or Republican ballot, based on their registration, and there was also an option for specifying magnification of the ballot on the screen, or even audio for blind people.

From 6-7 a.m., we set up the voting booths. We had to unplug all of them because they were facing the wrong way. We then rearranged them and plugged them back in. Each machine has a 5 hour battery, so this process went without a hitch. Pretty much all of the judges knew who I was and what my role has been as a very public critic of electronic voting and Diebold in particular. At around 6:30, representatives from Diebold arrived, and although my badge said "Avi" on it, I heard them refer to me as Professor Rubin, so I knew that they knew exactly who I was. In fact, some of the very senior Diebold executives who I recognized showed up, which makes me think that they knew I would be there, perhaps based on the Baltimore Sun article.

At 7 a.m., we opened the polls, and head judge Jim cast the first vote, to a round of applause from all of us. Voters trickled in, but at a slow pace. I felt some hostility from my fellow judges. This was not helped by what transpired next. A TV crew from Fox News showed up at the polls and asked the head judge if they could interview me. The head judge called a "super" judge at the county and came back and said no. The reporter asked to speak to the super judge, named Jackie, and was obviously not getting anywhere. She left rather angry, with a nasty exchange with head judge Jim and some unpleasant words with head judge Marie. I felt very uncomfortable. At that moment, there were no more voters in the room, and I offered to everyone in the room that I was not here to pull a publicity stunt, and that I would agree not to speak with any reporters throughout the day. This was a serious responsibility and duty that I took with the utmost respect for the system, and I would not let it turn into a mockery. A few minutes later, though, a photographer from the Baltimore Sun showed up with a reporter in tow. The same routine happened, only this time, they allowed the photographer to take pictures of me working and checking in voters and programming smartcards. However, they would not let the reporter talk to me. An angry exchange ensued, and when he left, I felt that tempers were pretty hot.

Once again, I reiterated my intensions of being nothing more than an objective judge today. The situation was worsened when one voter had a problem with his card which the voting machine spit out. He was given a new card, but I was concerned, and so I asked head judge Marie to count the ballots and check them against the count in the machine after he left. She did, and the count was fine. The smartcard really had failed and it was fixed. However, I overheard head judge Jim complain to Joy that I had made a big deal about that incident because the Baltimore Sun reporter was there. That was not true. It was a coincidence.

Over the next several hours, we all were busy checking in voters and dealing with running the election. Everybody calmed down, and we started joking around with each other and the mood became more positive. We only had one other minor press incident during the day. During breaks, I decided to educate Marie and Joy about the security problems of electronic voting machines. Amazingly, they really started to get it. They confessed that they had been ready to fight me, and that there was great animosity towards me, but that, in their words, I wasn't "such a bad guy after all". At the same time, I started realizing that some of the attacks described in our initial paper were actually quite unrealistic, at least in a precinct with judges who worked as hard as ours did and who were as vigilant. At the same time, I found that I had underestimated some of the threats before. I think that being an election judge was the best thing I could have possibly done to learn about the real security of elections.

In our paper, we described how the smartcards used by these machines had no cryptography on them, and we made the widely criticized claim that a teenager in a garage could manufacture smartcards and use them to vote 20 times. I now believe that this particular attack is not a real threat -- at least not in the primary I worked today. We had 9 judges and 5 machines. Whenever a voter took what seemed to be too long, we always had a judge ask them if they needed help, or if something was wrong. Also, the machines make a loud clicking sound when the smartcard is ejected, and we almost always had a judge standing there waiting to collect the card and give the voter a sticker, as they are ushered out.

In general, multiple voting attacks during the election are not likely to work in a precinct such as the one where I worked. Every hour or so, we counted all of the voter authorization cards (different from the smartcards), which were in an envelope taped to the machine, and compared them to the number of votes counted by the machine so far. I believe that if any voter somehow managed to vote multiple times, that it would be detected within an hour. I have no idea what we would do in that situation. In fact, I think we'd have a serious problem on our hands, but at least we would know it.

Every hour, we also counted the totals on the machines and compared them to the totals in the registration roster that we used to check people in. I was amazed at the number of countings and pieces of paper that we shuffled throughout the day in what was billed as a paperless electronic election.

There were also some security issues that I found to be much worse than I expected. All of the tallies are kept on PCMCIA cards. At the end of the election, each of those cards is loaded onto one machine, designated as the zero machine. (I found it interesting that Diebold numbered the machines 0 through n-1, disproving my notion that they don't have anyone on board who knows anything about Computer Science.) The zero machine is then connected to a modem, and the tallies are sent to a central place, where they are incorporated with the tallies of other precincts. In our case, the phone line was not working properly, so we went to the backup plan. The zero machine combined all the tallies from the PCMCIA cards that were loaded one at a time onto the machine. It then printed out the final tallies. One copy of that went onto the outside door of the building where there were talliers and poll watchers eagerly waiting. The other was put into a pouch with all of the PCMCIA cards, each wrapped in a printed tally of the machine to which it corresponds, and that pouch was driven by the two head judges to the board of elections office.

The security risk I saw was that Diebold had designated which machine would be the zero machine, and at one point, all of the vote tallies were loaded onto that one machine in memory. That would be the perfect point to completely change the tallies. There is no need to attack all of the machines at a precinct if someone could tamper with the zero machine. In fact, even when the modem is used, it is only the zero machine that makes the call. In the code we examined, that phone call is not protected correctly with cryptography. Perhaps that has been fixed. I was glad to see that the administrator PIN actually used in the election was not the 1111 that we used in our training, and that we had seen in the code.

One thing absolutely amazed me. With very few exceptions, the voters really LOVED the machines. They raved about them to us judges. The most common comment was "That was so easy." I can see why people take so much offense at the notion that the machines are completely insecure. Given my role today, I just smiled and nodded. I was not about to tell voters that the machines they had just voted on were so insecure. I was curious that voters did not seem to question how their votes were recorded. The voter verifiability that I find so precious did not seem to be on the minds of these voters. One woman did come up to Joy and complain that she wanted a paper ballot to verify. But, Joy managed to convince her that these machines were state of the art and that there was nothing to worry about, which was followed by a smile and a wink in my direction. I just kept quiet, given the circumstances. As an election judge, my job is to make the election work as well as possible, and creating doubts in the voters' minds at the polls does not figure into my idea of responsible behavior. Perhaps the lightest moment in the day came when one voter standing at his machine asked in the most deadpan voice, "What do I do if it says it is rebooting?" Head judge Marie turned white, and Joy's mouth dropped. My heart started to beat quickly, when he laughed and said "just kidding." There was about a two second pause of silence followed by roaring laughter from everyone.

I found the reaction to that joke interesting. Everybody was willing to believe that this had happened, and yet when it became clear that it didn't, we all felt relief. I'm sure that the other judges would have claimed that this was impossible, and yet, for a brief instant, they all thought it had happened.

There were a few unusual moments related to my previous work on e-voting. Several people recognized me from TV appearances and from the paper. Yesterday, I was on two CNN shows and the local ABC station criticising Diebold's voting machines, and last week, I was on the Today show and on TechTV. One voter who I was checking in, leaned over and said, "I know who you are." I just smiled. Then he asked me if he should even bother voting, and if I thought the machines would "hold out". I answered that my views were well known, but that today I was an election judge. Another voter asked me, "Aren't you that hacker guy?"

In the beginning of the election, we printed a "zero tape" of each machine. I found this to be the kind of charade that a confidence man would play when performing some sleight of hand. So, the machines printed each candidates name with a zero next to it. Somehow, that is supposed to mean that there are no votes counted on the machine? I don't know. I think I could write a five line computer program that would print the zero tally, and I don't see how that ties into the security of the election. In fact, that was not the only procedure that I thought served more as eye candy than real security. For example, the process for collecting the smartcards was for the unit judge to take the card from the voter and put it on a piano that was across the room. Every 15 minutes or so, the unit judge would take the cards and give them back to us book judges. When a Diebold rep showed up, I asked her about this, and she said that it was done to give the voters a sense that nothing was being kept on the smartcards about their voting session. After my experience today, I can say with total confidence that this would not have ocurred to any of the voters we had.

There was a very funny moment around 2:00 in the afternoon. A voter complained that she was a Democrat but had been given the Republican ballot. This required both head judges to void the ballot. It turned out that this had been my mistake when I coded the smartcard. In fact, I was the only one the entire day who made such a mistake. The less than young judges had a good time constantly reminding me of who the careless judge was at this election. One of them commented to me that there are many young people who are incompetent and many old people who can manage an election just fine, thank you.

I continue to believe that the Diebold voting machines represent a huge threat to our democracy. I fundamentally believe that we have thrown our trust in the outcome of our elections in the hands of a handful of companies (Diebold, Sequoia, ES&S) who are in a position to control the final outcomes of our elections. I also believe that the outcomes can be changed without any knowledge by election judges or anyone else. Furthermore, meaningful recounts are impossible with these machines.

I also believe that we have great people working in the trenches and on the front lines. These are ordinary people, mostly elderly, who believe in our country and our democracy, and who work their butts off for 16 hours, starting at 6 a.m. to try to keep the mechanics of our elections running smoothly. It is a shame that the e-voting tidal wave has a near hypnotic effect on these judges and almost all voters. I believe that after today's experience, I am much better equipped to make the arguments against e-voting machines with no voter verifiability, but I also have a great appreciation for how hard it is going to be to fight them, given how much voters and election officials love them.

We were not allowed to use cell phones or access email all day. On my way home from the polls, I called my voicemail at work. I had messages and requests for interviews from ABC News, the Baltimore Sun, the Washington Post, Wired News, CNN, several radio stations and the New York Times. So, this issue is not going away. Over the next few days, I'll be discussing my experience and probably sparring with the usual suspects in the various media outlets. My biggest fear is that super Tuesday will be viewed as a big success. By all accounts, everyone at my precinct felt that way. The more e-voting is viewed as successful, the more it will be adopted, and the greater the risk when someone decides to actually exploit the weaknesses of these systems.

It's now almost midnight, and I've been up since 5:00 a.m. I'm falling asleep as I type this, so I will end here. Good night.

© Scoop Media