Cops Canvass Report

This topic includes the entire report. However, each section is on a separate page to ease revision tasks. This page is not part of the report.

This is an infrastructure topic.

See also

• COPs Rov Report - This is the new official entry point and includes a form to capture reader information.
• COPs Rov Report Link - this is the post-entry link page which has the document attached.
• COPs Rov Report Admin - this is the administration page.
• Cops Canvass Report - This is the internal, web-based entry point.
• San Diego County Canvass Procedure - Project page for this effort.
• Cops -- The Cops web contains the database of information used in this project.
• All Precincts -- A summary of all the precincts in our 5% sample
• All Races -- Election results for Races in the November election based on our 5% sample.
• Cops Canvass Report Without Page Breaks -- This is identical to the report below but does not have any page breaks inserted. This works better if pasting into a word-processor document.
• Publish Cops Canvass Report -- topic to supervise production of PDF version of the report.

The report begins below. If you print this out, it will start on a new page (start your print on page 2). Use "Print Version" (click link at bottom) to avoid having superfluous information (left bar, top bar) in the printed report.

---

COPS Review of San Diego County Registrar of Voters Procedures
November, 2008 Presidential Election

CITIZENS' OVERSIGHT PROJECTS (COPs)

Printed on 03 Dec 2024

%STARTPUBLISH% %STOPPUBLISH% %STARTPUBLISH%

Foreword

This report was produced by volunteers and contributors without any corporate or foundation support.

Please visit http://www.copswiki.org/Common/COPsRovReport and submit your name to our reader list if you are provided with this report without first visiting that page. We want to track the distribution of the report and gather contact information to keep you up to date regarding additional activity on this election integrity project. The project page is http://www.copswiki.org/Common/ElectionIntegrity

This is document #C00026. For government agencies responding to requests and comments in this report, please include this number.

Copyright (C) Citizens' Oversight Projects
Creative Commons 2.0 noncommercial attribution

If you have comments or suggestions, please contact:
Raymond Lutz
raylutz@citizensoversight.org

Executive Summary & Introduction

This report is the result of a project initiated by Citizens' Oversight Projects (COPs) in 2008 to document and review the procedures used by San Diego County Registrar of Voters ("RoV") to process elections and create their certified result. The report addresses chain-of-custody issues, whether adequate in-process records are maintained, and describes serious issues of concern, including the loss of ballots, unexplained central tabulator crashes, and ballot box tampering.

A key aspect of this review was an attempt to follow the paper-trail of 5% of the precincts in the county, and reconstruct the results of the election. Unfortunately, the paper trail is insufficient to reconstruct the entirety of the results for the sample, but the attempt is useful to point out that such a reconstruction is impossible without enhancing the paper trail and computer logs, as well as numerous other problems.

Despite a return to paper ballots throughout California, systems used to count and report the vote -- both computerized and paper-based -- remain subject to election fraud vulnerabilities. San Diego County is no exception. There are numerous opportunities to improve citizens’ oversight and the quality and confidence level of the result, as well as to reduce the cost to process each election. Our review exposed a number of procedures that are technically incorrect, do not follow the law, or provide an opportunity for compromised Ro V officials to manipulate the outcome of the election. The top issues are summarized below.

• The most obvious deficiency of the Ro V is the lack of comprehensive policy and procedures documents. Such documentation is always the first step in any quality assurance program. It is essential for public oversight of elections processing so we can check that the procedures are correct and that they are being followed. In addition, there is no procedure to systematically deal with errors and omissions to improve those procedures and eliminate errors in the future, which is key to an effective quality assurance program. There is little confidence that, without any written plan, that the certified results of the election represent the will of the voters.
  
  
• A large number of voters remain disenfranchised due to the careless procedures of the Ro V. Although the Ro V is aware of these issues, they continue to maintain that there are no deficiencies. For example, the Post-Election Manual Tally ("PEMT") reviewed 1% of the precincts in the election and detected problems or lost ballots in 29% of those 17 precincts tested in the base sample. The Ro V ran the ballots for those precincts back through the scanners and confirmed the errors, but then stated that there were no errors at all because the rescan cleared them up. However, this perfunctory gesture merely confirmed that the election would likely have 29% of the precincts with errors (478 precincts) and about 500 ballots lost, or indeed many more. With errors of this magnitude, it may be necessary to completely reprocess the election or resort to a 100% manual tally. In addition, the Ro V prepared an inadequate report, producing only a five-page summary of the results of the PEMT instead of the recommended 800+ page (electronic) report specified by the Secretary of State ("SoS"), and they refused to enhance the report or explain why the ballots were missing.
  
  
• Our attempt to reconcile the number of signatures on sign-in rosters with the number of scanned ballots revealed the loss of about 9,000 ballots. It may be the case that these ballots are actively removed by the Ro V by an undocumented procedure. These ballots were not included in the PEMT, and their disposition never formally analyzed and remains a mystery. Somehow, most of these ballots reappear in the final canvass report, perhaps by adjusting the final figures.
  
  
• The audit trail is insufficient to allow an oversight group, such as COPs, to independently review that trail to check on the outcome of the election short of ordering a full recount of the ballots. Many of the ballots, such as the Vote-by-Mail (VBM) ballots are not reported in the central tabulator audit log, and there is no paper trail, such as scanner reports, for the VBM or provisional ballots. Access to this audit trail is difficult and delayed. Suggestions to correct these deficiency are enumerated.
  
  
• Tamper-evident seals are used by the Ro V to seal ballot containers. However, there were 99 cases of "tampering," i.e. broken or wrong seals, without any followup investigation, and the serial numbers on the seals are never recorded in companion documentation. Without such an investigation and report, the use of these seals is for show only. The careless handling ballots should be considered negligent, if not criminal.
  
  
• When each polling place closes, a "Ballot Statement" is prepared by poll workers to reconcile the number of blank ballots received with the number of voted ballots, provisional ballots, spoiled ballots, and blank ballots returned. In 83% of the sampled precincts, poll workers were unable to reconcile these counts, and in only one case (1.17%) did the poll workers reconcile the ballot counts and the count of ballots also matched the number of ballots later scanned by the Ro V.
  
  
• Review of the Diebold "GEMS" central tabulator audit log revealed a number of discrepancies that have not been fully explained, including system crashes, unrecognized error messages, undocumented starting and stopping, lack of an initial clearing of the tabulation, dozens of cases of capturing votes directly from DRE (touchscreen) machines contrary to the requirements set forth by the So S, and a general inadequacy of the audit log report.
  
  
• Although the Ro V has referred to a final "reconciliation procedure" to clear up the 9,000 missing ballots, 500 mis-scanned ballots, 83% of the sign-in rosters not reconciled with the count of ballots returned, and numerous central tabulator audit log discrepancies, there is no documented reconciliation procedure, no reconciliation report, no operator notes, and no way for anyone to know with confidence that the 133 precincts that were rescanned caught all the problems. There is no wonder that the Ro V is pressed for time during the canvass procedure as they operate on an ad-hoc basis and re-scan precincts up until the very last minute of the 29-day certification period and complain that they have inadequate time to complete the canvass.

This document enumerates the extent of this review, summarizes the results, and provides recommendations for improvement in procedures and law. Our data collection effort and the entirety of our interaction with the Ro V has been open to the public and can be reviewed on the CitizensOversight.org website. This report may be reviewed on the Internet{{https://copswiki.org/COPsRovReport This report may be reviewed on the Internet - }} for the most recent revision. We invite comments, corrections, and enhancements to our review.

The lead investigator in this work is Raymond Lutz, founder and coordinator of COPs. Mr. Lutz has extensive experience in the document processing field, in quality assurance procedures, has worked with standards organizations in the printer/scanner/fax area and has a Master's of Science degree in Electronics Engineering. Mr. Lutz was a candidate in the November 2008 election for the 77th State Assembly District seat in the California State Legislature and has proposed the Open Canvass method to virtually eliminate the possibility of electronic election fraud. Although related to this report, changes in procedure and law suggested by this report are not directly related to the Open Canvass method, and most are necessary regardless of the method of counting the ballots.

Status of the Investigation

Although the Ro V was generally cooperative and courteous in complying with our requests, in several cases they refused to answer questions, limited our ability to scan some documents, and did not provide any contact with Premier Election Solutions (formerly Diebold Systems) to follow up on central tabulator crashes and to get relevant central tabulator documentation, per their suggestion. Therefore, we do not view this report as "final" since these and other questions are still outstanding. However, the egregious nature of the deficiencies is such that publishing the report was justified now rather than waiting for the full extent of the research to be completed. This report can also serve as a starting point for future reviews and should be of value as a template for review of other counties' procedures.

Since our review project was not sanctioned by any county, state, or federal department, we had no ability to demand compliance with our requests for timely access to public documents and information. Generally speaking, the Ro V only reluctantly returned documents, and then only if it seemed they had no other choice. Therefore, our conclusions may be incomplete in inaccurate to some degree. However, any difficulty we had in reviewing the election system only underscores that the process is not observable and subject to documentation by citizens.

Methods of the Investigation

Our investigation included the following steps:

1. Determine the procedures intended to be used by the Ro V.
2. Check that these procedures were actually used.
3. Point out deficiencies in following the intended procedures.
4. Comment on the adequacy of those procedures and suggests improvements.

Unfortunately, because the Ro V does not maintain comprehensive policy and procedures documentation, determining the intent of the Ro V was much more difficult than we originally expected and required numerous document request, question and answer interactions with the Ro V, interview sessions, and video recording their operation.

Therefore, the following methods were used in our interaction with the Ro V.

• Video taping the procedures used by the Ro V
  • See: Election-night processing on the February 5, 2008, presidential primary election. This video demonstrates the process for administering the election and the Post-Election Manual Tally. This one-hour video is a good starting place for anyone curious about the procedures used by the Ro V to process the canvass on election night. The procedure is summarized for purposes of this report in a later section. The video does not, however, include every procedure. Mail and provisional ballot processing as well as all procedures prior to when the ballots reached the central "Tally Center" are not included in the video.
• Conversations with Ro V officials in various meetings
  • See: Nov. 21, 2008 Meeting with Deborah Seiler (video). After this initial meeting, the Registrar refused to allow us to record our meetings, and so we discontinued that approach and instead used written requests for information only. We also found that video recording was less than optimal because of the additional work required to turn the verbal comments of the Ro V into written documentation and the misperception that we were trying to catch the Ro V off-guard.
• Request/Response letters to the Registrar asking for information available under the California Public Records Act (CPRA)
  • Responses to these requests were not always provided within the 10-day time period provided by the CPRA. At times, it was necessary to appear before the County Board of Supervisors to obtain compliance with the law. That said, the responses were generally thorough, and most of our questions have been answered. Ro V staff members were always courteous and respectful.
• Requests for information (Q&A) not available under the CPRA.
  • These questions were sometimes skirted and avoided with the note that responses were not required under the CPRA, but cooperation improved as we continued our investigation. For example, we asked “Why were the 'lost' ballots not counted by the scanning equipment? What was the source of the error?” and the question was not answered because it is not a CPRA request. (This remains a serious issue covered by this report).
• 5% Sample of the November 2008 election.
  • Central to our project was an independent sample of 5% of the precincts. The exact method of choosing the 5% sample (85 precincts) and the data collected are described in detail later in the report. This sample was used as a means to detect errors by the Ro V over and above the Post-Election Manual Tally (PEMT), which is the first 1% of our 5% sample (comprising 20% of our sample). Thus, the 1% selected by the Ro V was 17 precincts and we added an additional 68 precincts. However, we were unable to access the actual ballots, so it was impossible for us to perform a manual tally on the additional 68 precincts or repeat a manual tally on the 17 precincts already tallied by the Ro V.

Structure of this Document

There are three main components of this document:

• Procedure Summary - provides an overview of the entire procedure used by the San Diego County Ro V to process the election
• Five Percent Review - A description of our review methodology.
• Issues of Concern Categories - The results of our review are "Issues of Concern" and are grouped into categories to provide context and further detail. Although some issues apply to more than one category, we discuss each issue only once, but may refer to it in other categories to acknowledge that it is relevant.

Each Issue of Concern has several components:

• The first section of an Issue includes a number, a title, a brief description, and a longer description.
• The second section describes any proposals to change for the Ro V as a follow-up to this report.
• The third section details actions requested for the state legislature so as to improve state law.

There are two types of issues, the first is numbered starting with 'A,' which means it is an actual issue. The second type are numbered starting with 'C,' which indicate areas where we need to do more work to collect information in our project.

Next Steps

It is important to list a number of desired outcomes from the publication of this report. As mentioned, COPs has no legal authority to obligate the Ro V, the County of San Diego, nor the State of California to take any steps as a result of this document. However, the following steps are requested:

Response by the Registrar of Voters

We have made quite a number of assertions throughout this document regarding the activities of the Ro V. Some of these assertions may be inaccurate We invite the Ro V to refute errors, suggest corrections and comment profusely.

Nearly all of the issues, with only a few exceptions, have specific questions or proposals for the Ro V. Instead of repeating nearly all of the issues separately, we will simply suggest that the Ro V attempt to address each and every issue enumerated in the Issues of Concern, particularly with respect to the section "Questions to the Ro V".

Steps by the Secretary of State

We encourage the Secretary Of State to review the Issues of Concern and comment on each issue, particularly where they can play a role in improving the performance of the Ro V.

Steps by the State Legislature

For each of the Issue of Concern, we have explicitly detailed any changes in Elections Code that may be appropriate. We hereby request that the California State Legislature consider our recommendations carefully, and sponsor legislation that eliminates the risks to a viable election process created by the practices of the San Diego County Ro V and likely repeated in other counties across the state.

Our representatives in the Legislature should review each and every Issue of Concern, particularly with respect to the section of each issue "Legislative". In each case, we urge the those reviewers to place each issue in context by reading the descriptions of the larger issue in the Procedure Summary and Issues of Concern rather than reading only the text of the specific Issue of Concern.

Acknowledgments

The following people were most helpful in the generation of this report:

• Raymond Lutz - primary investigator and report author.
• Linda Poniktera - participated in meetings, election night oversight, manual tally oversight, document review
• Sal Magellenez - participated in meetings, election night oversight
• Brina Rae Schuchman - Save-R-Vote - participated in meetings, election night oversight
• Lisa Davis - Cops member, entered almost all the scanner tape data.
• Valerie Sanfilippo - Assisted with roster inspection
• Joe Sain - Assisted with Ballot Statement data entry
• Ken Karan - Legal advice and document review

Documents Referenced

The following documents were provided by the Ro V as a response to our request or obtained from other sources. These documents will be referenced in later sections by name. "RoV Procedure Documents" specify procedures used in each election while "RoV Election Documents" are specific to this election.

The casual reader of this report may move directly to Procedure Summary while keeping in mind the fact that these documents and abbreviations are defined here.

• Voluntary Voting Systems Guidelines{{https://copswiki.org/Common/VoluntaryVotingSystemGuidelines Voluntary Voting Systems Guidelines - were authored by the Technical Guidelines Development Committee (TGDC), a committee authorized under the HELP America Vote Act (HAVA) of 2002, and researchers at the National Institute of Standards and Technology (NIST) for the Election Assistance Commission (EAC). These guidelines were authored primarily to guide voting machine manufacturers in their design of voting systems.}} were authored by the Technical Guidelines Development Committee (TGDC), a committee authorized under the HELP America Vote Act (HAVA) of 2002, and researchers at the National Institute of Standards and Technology (NIST) for the Election Assistance Commission (EAC). These guidelines were authored primarily to guide voting machine manufacturers in their design of voting systems.
• Logic & Accuracy Testing Procedure{{https://copswiki.org/Common/M829 Logic & Accuracy Testing Procedure - An RoV Procedure Document that specifies how to confirm basic operation of the electronic scanning equipment.}} An RoV Procedure Document that specifies how to confirm basic operation of the electronic scanning equipment.
• Ballot Order Procedure{{https://copswiki.org/w/pub/Common/M717/COP_PRA_Response_Attach_2.pdf Ballot Order Procedure - An RoV procedure document that specifies how the number of ballots is determined.}} An RoV procedure document that specifies how the number of ballots is determined.
• Ballot Order Spreadsheet{{https://copswiki.org/w/pub/CommonM821/C00019_Response_20.3.3_Ballot_order_and_supplemental_order_for_11-08.xls Ballot Order Spreadsheet - An RoV Election Document that lists the quantity of ballots ordered for each precinct and supplemental orders. Includes Sequence Number to Precinct Number conversion.}} An RoV Election Document that lists the quantity of ballots ordered for each precinct and supplemental orders. Includes Sequence Number to Precinct Number conversion.
• Ballot Inventory Sheet{{https://copswiki.org/w/pub/Common/M717/COP_PRA_Response_Attach_1.pdf Ballot Inventory Sheet - An RoV Election Document. This is a sample of the document sent to each precinct leader to verify the count of blank ballots received.}} An RoV Election Document. This is a sample of the document sent to each precinct leader to verify the count of blank ballots received.
• Street Indexes{{https://copswiki.org/Cops/StreetRosters Street Indexes - An RoV Election Document that lists voters by address and each is checked off as they vote. About half of our 5% sample were scanned but we discovered they were incomplete as most polling places did not continue to complete these after 6 p.m. on election day.}} An RoV Election Document that lists voters by address and each is checked off as they vote. About half of our 5% sample were scanned but we discovered they were incomplete as most polling places did not continue to complete these after 6 p.m. on election day.
• Ballot Statements{{https://copswiki.org/Cops/BallotStatements Ballot Statements - An RoV Election Document. These were initially withheld by the RoV due to legal concerns of showing signatures. (Requested in C00022). These have been scanned by the Registrar with the signatures concealed.}} An RoV Election Document. These were initially withheld by the RoV due to legal concerns of showing signatures. (Requested in C00022). These have been scanned by the Registrar with the signatures concealed.
• Collection Center Logs{{https://copswiki.org/Cops/CollectionCenterLogs Collection Center Logs - Reports from 80 collection centers were scanned from RoV on 2009-03-23. Each report handles 21 precincts, on the average. No logging of seal conditions or serial numbers.}} Reports from 80 collection centers were scanned from RoV on 2009-03-23. Each report handles 21 precincts, on the average. No logging of seal conditions or serial numbers.
• Collection Center Seal Report{{https://copswiki.org/w/pub/Common/M717/COP_PRA_Response_Attach_4.pdf Collection Center Seal Report - Describes 6 seals that are missing or wrong}} Describes 6 seals that are missing or wrong
• Tally Center Log{{https://copswiki.org/Common/M828 Tally Center Log - Use by incoming inspectors at the Tally Center. Describes 99 seals broken or wrong, 6% error rate.}} Use by incoming inspectors at the Tally Center. Describes 99 seals broken or wrong, 6% error rate.
• Security Seal Standards{{https://copswiki.org/Common/SecuritySealStandards Security Seal Standards - includes ISO/PAS 17712 - Freight container seal standards.}} includes ISO/PAS 17712 - Freight container seal standards.
• Batch box label (Used as tracking device when in facility).
• Scanner Tapes for our 5% Sample{{https://copswiki.org/Cops/ScannerTapes Scanner Tapes for our 5% Sample - These pdf files contain three scanner tapes each, and were manually scanned by COPs volunteers.}} These pdf files contain three scanner tapes each, and were manually scanned by COPs volunteers.
• Manual Tally Procedure{{https://copswiki.org/Common/M830 Manual Tally Procedure - An RoV Procedure Document}} An RoV Procedure Document
• San Diego County Manual Tally Report for 2008-11-04 election{{https://copswiki.org/Common/M691 San Diego County Manual Tally Report for 2008-11-04 election - This five-page report is extremely deficient compared with the recommendation of the Secretary of State, which would result in about 800 pages. This report includes NO vote totals and only a count of the ballots.}} This five-page report is extremely deficient compared with the recommendation of the Secretary of State, which would result in about 800 pages. This report includes NO vote totals and only a count of the ballots.
• Audit Log (of central tabulator){{https://copswiki.org/Common/M831 Audit Log (of central tabulator) - An RoV Election Document produced by the GEMS Central Tabulator.}} An RoV Election Document produced by the GEMS Central Tabulator.
• Canvass Reports{{https://copswiki.org/Cops/CanvassReports Canvass Reports - Certified results of the RoV for our 5% Sample.}} Certified results of the RoV for our 5% Sample.
• Precinct Sequence 1563{{https://copswiki.org/Cops/PrecinctSeq1563 Precinct Sequence 1563 - which is one of the few Ballot Statements that reconciled completely. The precinct had no touchscreen ballots. The ballot statement discloses 565 ballots counted and that matches the number of non-provisional signatures (565). However, the scanner tape from the Tally Center says there were only 550 cards cast.}} which is one of the few Ballot Statements that reconciled completely. The precinct had no touchscreen ballots. The ballot statement discloses 565 ballots counted and that matches the number of non-provisional signatures (565). However, the scanner tape from the Tally Center says there were only 550 cards cast.

Other Documents and media

• Open Canvass method{{https://copswiki.org/Common/OpenCanvass Open Canvass method - A method to reduce election processing vulnerability based on scanning all ballots and comparing vote extraction from several competing actors}} A method to reduce election processing vulnerability based on scanning all ballots and comparing vote extraction from several competing actors
• Video of the February 5, 2008 Presidential Primary Canvass{{https://copswiki.org/Common/M434 Video of the February 5, 2008 Presidential Primary Canvass - }}
• Nov. 21, 2008 Meeting with Deborah Seiler (video){{https://copswiki.org/Common/M688 Nov. 21, 2008 Meeting with Deborah Seiler (video) - After this initial meeting, the Registrar refused to allow us to record our meetings, and so we discontinued that approach and instead used written requests for information only.}} After this initial meeting, the Registrar refused to allow us to record our meetings, and so we discontinued that approach and instead used written requests for information only.
• Secretary of State Top-to-Bottom Review{{https://copswiki.org/Common/M860 Secretary of State Top-to-Bottom Review - }}
• All Precincts{{https://copswiki.org/Cops/AllPrecincts All Precincts - provides results of our data collection activity for all the precincts in our 5% sample.}} provides results of our data collection activity for all the precincts in our 5% sample.
• All Races{{https://copswiki.org/Cops/AllRaces All Races - provides a link to a separate page for each race in the election and lists the vote count from each precinct in the 5% sample.}} provides a link to a separate page for each race in the election and lists the vote count from each precinct in the 5% sample.
• Kathy Dopp, 'Checking election outcome accuracy Post-election audit sampling' {{http://electionmathematics.org/em-audits/US/PEAuditSamplingMethods.pdf Kathy Dopp, 'Checking election outcome accuracy Post-election audit sampling' - Derives a simple formula to determine the number of precincts that must be sampled to validate election results with known apparent vote counts.}} Derives a simple formula to determine the number of precincts that must be sampled to validate election results with known apparent vote counts.
• Potrero Planning Group Recall Vote Count Video, 2007-12-11{{https://copswiki.org/Common/M351 Potrero Planning Group Recall Vote Count Video, 2007-12-11 - This is the entire initial vote count performed on December 11, 2007 demonstrating the method of manual tallying used by the San Diego County Registrar of Voters.}} This is the entire initial vote count performed on December 11, 2007 demonstrating the method of manual tallying used by the San Diego County Registrar of Voters.

Interaction Documents

The following documents record our requests and responses by the Ro V:

• C00014: Letter to Registrar of Voters requesting Statement of Votes Cast, 2008-10-03{{https://copswiki.org/Common/M667 C00014: Letter to Registrar of Voters requesting Statement of Votes Cast, 2008-10-03 - We requested that the RoV create two copies of the scanner tapes, as specified by law, so that we could start our review of the election right away. They refused, forcing us to wait until the election was certified before we could start to review the scanner tapes.}} We requested that the RoV create two copies of the scanner tapes, as specified by law, so that we could start our review of the election right away. They refused, forcing us to wait until the election was certified before we could start to review the scanner tapes.
• C00015: Letter to Secretary of State requesting support of our request to Registrar of Voters requesting Statement of Votes Cast, 2008-10-08{{https://copswiki.org/Common/M668 C00015: Letter to Secretary of State requesting support of our request to Registrar of Voters requesting Statement of Votes Cast, 2008-10-08 - We forwarded our letter to the RoV (C00014) to the Secretary of State in an effort to persuade the county to comply with access to the scanner report tapes prior to the end of the election. This request was refused, with the rationale being that state law applies only in the precinct and they are not required to create a second scanner tape prior to election certification.}} We forwarded our letter to the RoV (C00014) to the Secretary of State in an effort to persuade the county to comply with access to the scanner report tapes prior to the end of the election. This request was refused, with the rationale being that state law applies only in the precinct and they are not required to create a second scanner tape prior to election certification.
• C00016: Letter to RoV: Manual Tally Report Questions, 2008-11-20{{https://copswiki.org/Common/M691 C00016: Letter to RoV: Manual Tally Report Questions, 2008-11-20 - This three-page request was submitted prior to the closing day of the canvass period and pointed out that they were not using the appropriate format for their PEMT report.}} This three-page request was submitted prior to the closing day of the canvass period and pointed out that they were not using the appropriate format for their PEMT report.
• C00016 R: Response by County Counsel regarding Nov. 20 Letter to the RoV, 2008-11-25{{https://copswiki.org/Common/M689 C00016 R: Response by County Counsel regarding Nov. 20 Letter to the RoV, 2008-11-25 - This response was the least cooperative and would not answer simple questions regarding why ballots were missing in the PEMT report.}} This response was the least cooperative and would not answer simple questions regarding why ballots were missing in the PEMT report.
• C00017 - Letter to San Diego Registrar of Voters regarding Election Procedures (2008-12-02){{https://copswiki.org/Common/M716 C00017 - Letter to San Diego Registrar of Voters regarding Election Procedures (2008-12-02) - This five-page request was submitted on the closing day of the canvass period.}} This five-page request was submitted on the closing day of the canvass period.
• C00017 R - Response to C00017 by San Diego Registrar of Voters regarding Election Procedures (2008-12-16){{https://copswiki.org/Common/M717 C00017 R - Response to C00017 by San Diego Registrar of Voters regarding Election Procedures (2008-12-16) - Includes Ballot Order Procedure, One Percent Manual Tally Procedure, Collection Center Comments on Carton Seals.}} Includes Ballot Order Procedure, One Percent Manual Tally Procedure, Collection Center Comments on Carton Seals.
• C00019 - Letter to San Diego Registrar of Voters regarding Election Processing (2009-01-08){{https://copswiki.org/Common/M819 C00019 - Letter to San Diego Registrar of Voters regarding Election Processing (2009-01-08) - This 19-page request was a followup to C00017, and was submitted twice, the second time (C00021) in an abbreviated format to aide in processing.}} This 19-page request was a followup to C00017, and was submitted twice, the second time (C00021) in an abbreviated format to aide in processing.
• C00019 R - Response to C00019 and C00021 by San Diego Registrar of Voters regarding Election Procedures (2009-02-24){{https://copswiki.org/Common/M821 C00019 R - Response to C00019 and C00021 by San Diego Registrar of Voters regarding Election Procedures (2009-02-24) - }}
• C00022 - Questions to Registrar of Voters on Nov, 2008 Election (Part 3) (2009-09-01){{https://copswiki.org/Common/M878 C00022 - Questions to Registrar of Voters on Nov, 2008 Election (Part 3) (2009-09-01) - Request for Ballot Statements, Street Indexes, Question about ballot counts, and Premier contact.}} Request for Ballot Statements, Street Indexes, Question about ballot counts, and Premier contact.
• C00022 R: Response to C00022 by Registrar of Voters (2009-09-09){{https://copswiki.org/Common/M879 C00022 R: Response to C00022 by Registrar of Voters (2009-09-09) - Answered some questions. Ballot Statements took several weeks to finally get in full, no contact to Premier Election Solutions provided.}} Answered some questions. Ballot Statements took several weeks to finally get in full, no contact to Premier Election Solutions provided.

Abbreviations and Terminology

If you do not find the definition here, please also see this reference:
http://www.eac.gov/vvsg/g/definitions-of-words-with-special-meanings

• Collection Centers - 80 centers throughout the county where ballots are collected from individual precincts, each averaging 21 precincts.
• CVR - Cast Vote Record - Archival record of all votes produced by a single voter. Cast vote records may be in electronic, paper, or other form. Electronic cast vote records are also called ballot images. In San Diego County, the durable paper ballot is the CVR.
• DRE - Direct Recording Equipment - Voting machines that directly record the vote of the voter without using paper ballots. These machines have superior usability for disabled voters, but are inherently subject to election fraud risks, and therefore are no longer used except for one unit per precinct for use by disabled voters, and their vote is transferred to paper ballots and processed with the rest.
• IVVR - independent voter-verifiable records - all voting systems must include a vote-capture device that uses independent voter-verifiable records (IVVR). For example, durable paper ballots that are scanned represents a ballot that can be easily read by the voter and interpreted by machines.
• PAV - Permanent Absentee Voter - Deprecated. Now "VBM."
• PI - Precinct Inspector - The lead poll worker at each polling place.
• RoV - San Diego County Registrar of Voters
• Seq# - The precinct sequence number, from 0001 to 1650. This number is used internal to the Ro V and relates to one polling place.
• SPUW - Supply Pick-Up Weekend - The weekend prior to election day when supplies are distributed to polling places by having polling place workers pick up their supplies.
• SoS - California Secretary Of State CA - This elected office is responsible for overseeing the elections process.
• Tally Center - The central office of the Ro V where the main task of scanning ballots and compiling the final certified canvass occurs.
• VBM - Vote-by-Mail - Previously called PAV, permanent absentee voters.
• Voter Data File - Information about each registered voter is maintained in a database, including whether the voter has voted, whether they have requested a VBM ballot, their digitized signature, etc.

Canvass Procedure Summary

This section of the Cops Canvass Report describes the overall process used to conduct elections in San Diego County and determine the result. The description below is our best attempt to document the procedures used by the Ro V based on our understanding of the Elections Code, observations, questions, and the few documents that do exist.

Unfortunately, there is no comprehensive document maintained by the Ro V that describes their procedures as a whole, although there are several documents that do describe some portions of their process. As a result, to determine the procedures used by the Ro V we had to make assumptions, arrange to observe related activities, video record the actual process, or conduct meetings and Q&A exchanges. We encourage the Ro V or anyone else to submit corrections to the description below so that it accurately reflects current practice. We regard the absence of a policy and procedure document as a severe deficiency (See Issue A001: "Lack of Comprehensive Procedure Documentation") and prerequisite to implementation of a legitimate, comprehensive quality assurance program.

We also encourage the reader to view the Video of the February 5, 2008 Presidential Primary Canvass to see the handling of the ballots once they enter the Ro V office.

The California Secretary of State (So S) made an extensive Top-to-Bottom Review of all elections procedures in California, and this review resulted in changes to the procedures used in San Diego County, including a change from touch-screen machines provided by Diebold Systems (now Premier Election Solutions) to paper ballots that are scanned in the Ro V central office using scanners originally intended for use at polling places (also provided by Diebold) and then the result compiled using a Diebold "GEMS" central tabulator.

The procedure description below does not go into great detail about DRE touchscreen machines because they are a very small part of the total election ballot count, amounting to only about 750 ballots county wide. Those ballots are currently converted to paper ballots by hand by Ro V staff prior to scanning. Most precincts did not use touchscreen machines at all, with, in our sample, only 15 of 85 precincts using them at all (17%) and comprising only 49 votes of more than 34,000, or 0.14%. Prior to the top-to-bottom review by the Secretary of State, this was the most significant vulnerability. Thanks to the changes made in that review, we can essentially ignore this issue and concentrate on other issues.

If there are Issues of Concern that relate to a specific step in the procedure, those issues are listed only in brief form at the end of that section. Each one of the issues is expanded in more detail in a section of the Issues of Concern most closely related to that issue. Some Issues of Concern are related to more than one category, and if so, it is expanded in full in the category felt to be most relevant and listed in the other categories in brief form.

Preparation

Logic & Accuracy (L&A) Testing Procedures

• Defining Document: Logic & Accuracy Testing Procedure
• Working Document: (None)

This procedure is limited to testing the ballot scanners to confirm that each type of ballot and each race are correctly tallied. This is not a stress test nor a quality assurance test. The test is a procedure to verify that the software counting the ballots (in this case embedded in the scanners) will associate the location of a vote marked on a ballot with the correct candidate or measure on each of the many ballot configurations use by different voting precincts. The results show only that the software functions in a pre-established "Test Mode," and not in the real world "Election mode." In other words, the process is one of testing the test. These testing procedures test only the scanning process and do not test any human performance factors, such as procedures in the polling place, accuracy of the feeding process, chain of custody prior to and within the walls of the Ro V. Since it is conducted in an isolated test configuration that does not include so many aspects of election-day processing, it says little about how the entire system will operate on Election Day. However, this procedure is essential to confirm that a darkened bubble in a specific place on a specific ballot type results in an accurate record of the vote for the correct race.

Our project team has not witnessed this process nor video recorded it for review. It is likely that we will have further recommendations for improvement after our review is complete.

Review Status:

• Issue C001: Logic & Accuracy Testing Not Witnessed by COPs
  Logic & Accuracy Testing Procedures not witnessed nor video recorded by our project team.

• Issue C001: Question to Ro V
  Please provide advance notice to our project team so we may witness and video record Logic & Accuracy Testing.

Blank Ballot Printing and Allocation

• Defining Document: Ballot Order Procedure
• Working Document: Ballot Order Spreadsheet

Ballots are ordered and printed in the quantity as specified by the "Ballot Order Spreadsheet" and according to the Ballot Order Procedure so that there are sufficient ballots at each polling place in each language required by law. The ballots are counted and grouped by precinct by Ro V staff in preparation for pickup.

Review Status:

• Issue C002: Ballot Order Chain of Custody
  We did not review the process of maintaining control of blank ballots and reconciliation at the precinct level. There is a concern regarding chain of custody of blank ballots. Is there a vulnerability to fraud based on accessing blank ballots and then removing and replacing completed ballots with those blank ballots which have been cast illegally?

Supply Pickup Weekend (SPUW)

• Defining Document: None
• Working Document: (None)

Supplies are distributed to the precincts during the weekend prior to election day. These include:

• Temporary Voting Booths
• Cardboard Ballot Boxes
• Touchscreen voting machines
• Blank Ballots
• Sign-in Rosters
  • Blue, newly registered voters
  • White, regular voters marked to indicate if the voter is being sent their ballot by mail.
  • Pink, voters who have not voted for a while but are still registered.
  • Peach, blank sheets for provisional voters
• Street Indexes
  • Voters names sorted by address
• Ballot Statements
• Peach envelopes for provisional ballots
• Tamper-evident seals
• Ballot Inventory Sheet - Two part form to confirm number of ballots distributed (see below).

Review Status:

• Issue C003: SPUW Not Witnessed by COPs
  Supply pickup weekend not witnessed nor video recorded.

Blank Ballot Inventory Verification

• Defining Procedure Document: (None)
• Working Document: Ballot Inventory Sheet

The Precinct Inspector is instructed to count the ballots, verify the quantities listed, sign and date the two-part "Ballot Inventory Sheet", send (perhaps by mail) the white copy to the Ro V office and retain the yellow copy.

Although Ro V staff attempts to accurately count the blank ballots, mistakes do occur, and this verification by the Precinct Inspector should improve reliability of the count of blank ballots.

Review Status:

• We received a completed sample Ballot Inventory Sheet.

• Issue A004: No Ballot Inventory Report -- No report is generated regarding whether any errors occurred during SPUW, including the count of ballots.

Election Day -- At the Polling Place

• Defining Document: Precinct Worker Instructions -- we never got a copy of this. Ro V claimed it was on their website.
• Working Documents:
  • Sign-in Rosters
  • Street Indexes
  • Ballot Statements

Review Status:

• Issue C004: Precinct Worker Instructions
  RoV indicated that precinct worker instructions were available for review on their website but those are not really available to the public. We need to review these instructions.

• Issue C004: Question to Ro V
  Please provide Precinct Worker Instructions and related procedures documents.

Voter Sign-In

Voter provides name and address to poll worker and they look up the voter in the Blue, White, or Pink rosters. Poll worker confirms voter by matching the name and address.

• If the voter is found on the Blue, White, or Pink rosters
  • and they are not marked as a Vote-by-Mail (VBM) voter on the rosters (typically by an "M" or similar designation), then they simply sign the roster.
  • Otherwise, if they are a VBM voter, then
    • If they have their VBM ballot to surrender, they sign the Blue, White, or Pink roster over the "M" (or similar) designation.
    • Otherwise, if they do not have their VBM ballot to surrender, they do not sign the Blue, White or Pink roster and are processed as a provisional voter.
• If the voter is not found on the Blue, White, or Pink rosters,
  • the poll workers is first supposed to try to help the voter find the correct precinct for voting. Sometimes it is an adjacent polling place (even in the same building) or nearby. This is very important because the ballots at the precinct may not be the correct ones for the voter and may not include some races or issues that they are allowed to vote on while the provided ballot may include some races that are inappropriate for that voter. {{One of our reviewers (KK) said that poll workers are not trained for this. What they are trained to do is pressure the voter into accepting a provisional ballot. At one election, I pressured the ROV official on site (CSUSD) to track a voter’s registration and, quite easily, determined that this voter’s correct polling place was nearby.}}
  • otherwise, and in the case of a VBM voter with no ballot to surrender, the voter signs the peach roster and complete a provisional ballot, including the envelope.

Note: Signatures on the Blue, White or Pink rosters are not routinely validated or reviewed. However, since precincts are relatively small and locating in neighborhoods, precinct workers may know the voters.

Poll workers are also supposed to update the Street Index which lists the voters by address. However, the updating of these sheets is not required after 6 p.m. and therefore many voters, estimated at 30% are not included on the sheets which invalidates this as an audit tool.

If the voter has a completed VBM ballot, it can be dropped off at the polling place. There is no logging procedure for these ballots at the precinct level and they are not counted and the voter does not sign any roster. (This is a significant deficiency in the chain of custody for VBM ballots. See Issue A010: "VBM Ballots Not Logged at Precinct"

Review Status
We reviewed the sign-in rosters for a portion of our 5% sample and counted the signatures. We were unable to scan these documents.

• Issue A010: VBM Ballots Not Logged at Precinct
  VBM Ballots were not logged, counted, or reported by the precinct.

Voting

Each voter that properly signs in is provided with an appropriate ballot according to their language and party designation, if appropriate, and directed to a voting booth. After voting, each voter places the ballot in the ballot box or at least witnesses their ballot being placed into the box. The first voter of the day is supposed to witness an empty box prior to the seal being placed on the box.

If the voter chooses to use a touchscreen machine, then they use that machine and their vote is later copied onto a paper ballot. It is worth noting that they are required to copy DRE ballots to paper ballots because DREs can’t be trusted to be virus free. The So S ordered, in their Top to Bottom Review that an “air gap” be created to prevent the very unsecured DREs from being connected to the very unsecured central tabulator. If this is done, at least you eliminate DREs and the entry point for malicious software. (However, we noted that DRE's were connected to the central tabulator and several dozen DRE ballots directly loaded into the central tabulator contrary to the directive of the So S in this election, which could have allowed malicious software to be loaded into the central tabulator. See Issue A043 - Audit Log Discrepancies to put this issue in context.)

If the voter makes a mistake, they can return the ballot to the poll workers and this ballot is considered "spoiled" and they are then supplied with a new blank ballot. (Not sure if there is tracking of spoiled ballots, i.e. separate roster where the voters signs to confirm that they spoiled their ballot.)

Closing the Polls

When the precinct closes, the precinct workers open the ballot box, count the ballots, and complete the Ballot Statement. The Ballot Statement includes a worksheet to allow the poll workers to account for the ballots, and according to the state Election Code, they are obligated to reconcile these counts.{{Apparently, the requirement that the precinct workers must complete the Ballot Statement and account for every ballot is in dispute. From a recent appellate brief:

Respondent Violated the Elections Code Requirement for an Accounting of Official Ballots

The Elections Code § 14405 requires the following:

1. The members of the precinct board shall account for the ballots delivered to them by returning a sufficient number of unused ballots to make up, when added to the number of official ballots cast and the number of spoiled and canceled ballots returned, the number of ballots given to them. The officers receiving returned ballots shall compel this accounting.
2. The precinct board shall complete the roster as required in Section 14107, and shall also complete and sign the certificate of performance prescribed in Section 15280, if that section applies.

Section 14107 (Elec. Code § 14107, sub. (a).) requires poll workers to affirm the following:

"We further certify that the total number of official ballots received, voted, rejected, spoiled and canceled, found in the ballot container and the number accounted for is as indicated on the ballot statement."

Appellant’s review of Respondent’s ballot statements revealed that poll workers did not account for the ballots as required and Respondent did not compel them to. (Plaintiff’s Exhibit 7, 2 AA 295-313.) In fact, Respondent’s official policy is to relieve poll workers from their duties to account for the ballots. (Plaintiff’s Exhibit 8, 1 AA 314 (last paragraph); Plaintiff’s Exhibit 3, 1 AA 284:25-26.)

A Dispute Exists as to the Duty to Account for Ballots under the Elections Code
Respondent states that “precinct workers are not required to certify that they have fully accounted for all ballots. Rather, the Legislature only requires that the precinct workers certify that ‘the number accounted for is as indicated on the ballot statement.’” (2 AA 375:16-18 (quoting Section 14107).) This logic leads to the conclusion that the legislative intent is merely to require that a poll worker put a number on the ballot statement and certify that the number is the number the worker put on the statement. This logic requires that one ignore the mandate that poll workers “shall account for the ballots delivered to them.” (Elec. Code §14405, subd. (a).) The obvious intent of accounting for the ballots is to ensure that unused ballots cannot be illegally “voted” and used to replace offending legitimate ballots by those with malicious intent. Respondent’s assertion that accounting for ballots after the semifinal official canvass, when the votes have already been counted and reported to the Secretary of State, neither complies with the code nor mitigates the risks involved. A late reconciliation of the number of ballots will not determine whether unused ballots have been used for illegitimate purposes, or whether legitimate ballots have been tampered with.}}, as follows:

• Blank Ballots Received
  • Total unused Ballots
  • Total voted paper ballots
  • Total Provisional ballots
  • Total spoiled ballots
  • Sum of the above three items, should equal the ballots received.

• Signatures
  • Blue pages signatures
  • White pages signatures
  • Pink pages signatures
  • Peach Pages Signatures
  • Total signatures, sum of the above four items.

• Number of touchscreen ballots

• Voted Ballots
  • Voted Paper Ballots
  • Voted Provisional Ballots
  • Touchscreen ballots
  • Total voted ballots, sum of the above three items, should equal the total signatures.

After completing the ballot statement, the ballots are placed in cartons suitable for transportation sealed with tamper-evident seals. DRE memory cards are placed into plastic envelopes and similarly sealed.

Review Status
Our oversight project included scanning 5% of the Ballot Statements for the November 2008 election, which can be reviewed here: Ballot Statements. It was very difficult to get these documents because the Ro V claims that the poll-worker signatures cannot be scanned, and so they had to be redacted prior to scanning. See Issue A009 - "Ballot Statements not Scannable").

• Issue A005: No Seal Serial Number on Ballot Statements
  Serial numbers of the tamper-evident seals are not included on Ballot Statements.

• Issue A006: Ballot Statements - Few balanced
  Only a few of the Ballot Statements had figures that balanced, and only one precinct had all the ballots correctly scanned. See Unscanned Ballots for a full analysis of this problem.

• Issue A007: Ballot Statements - Removed Write-ins Not Documented
  Ballot Statements did not include a count of the number of write-ins and damaged ballots removed.

• Issue A008: Ballot Statements - Office Use Section Not Explained -- Ballot Statements have an "Office Use Only" section does not include an explanation to allow the public to understand how it is being used.

• Issue A009: Ballot Statements Not Scannable
  Ballot Statements must be scannable in their entirety, including signatures of precinct workers who sign them.

Collection Centers

• Working Documents: - Collection Center Logs

There are 78 collection centers around the county and each one collects ballot cartons and other materials from approximately 21 precincts each, on the average. Workers at the collections centers complete log sheets that include the time and number of ballot cartons collected from each precinct.

Review Status

• In the November 2008 election, 6 seals were noted as wrong or broken and reported to us in the Collection Center Logs. This figure differs substantially from the (later) figure from the Tally Center Log, where 99 seals (6%) were wrong or broken. This issue is discussed in the Chain Of Custody section.

• Issue C005: Collection Center Activities not Observed by COPs
  We did not witness nor record activities at any collection centers.

• Issue A012: Collection Center Seal Logs Lack Serial Numbers - Authorized personnel at Collection Centers are required to inspect the tamper-evident seals, but there is no place on the log sheet to document the seal numbers nor to note whether the seals were intact.

Tally Center Operations

The collection centers then transport the ballot cartons and other materials to the central Ro V facility, known as the "Tally Center".

COPs Five Percent Review

COPs conducted a review of Ro V procedures by gather all available and relevant documentation on a 5% random sample of the 1697 precincts, i.e. 85 precincts.

Sample Size

The analysis by Kathy Dopp, 'Checking election outcome accuracy Post-election audit sampling' {{http://electionmathematics.org/em-audits/US/PEAuditSamplingMethods.pdf Kathy Dopp, 'Checking election outcome accuracy Post-election audit sampling' - Derives a simple formula to determine the number of precincts that must be sampled to validate election results with known apparent vote counts.}} Derives a simple formula to determine the number of precincts that must be sampled to validate election results with known apparent vote counts.

The following parameters govern the sample size:

• N = Total number of audit units (= number of precincts, or 1697 for San Diego County).
• w = number of votes for the winner with the least number of votes.
• r = number of votes for the runner-up with the most number of votes.
• k = a constant k: 0 < k < 1, the assumed maximum rate of margin error that could occur without raising enough suspicion to be detected without an audit. Choosing a value of 1 implies that the perpetrator could change all the ballots in any single precinct and no one would notice. Since this would likely be noticed, the value of 0.40 is a common value, that if 40% of the ballots in a precinct were changed, it would be apparent without an audit.
• b = the total number of ballots cast
• P = the probability that the sample will detecting one or more corrupt vote counts, usually set to 95% (0.95) or 99% (0.99).

The spreadsheet formulas to calculate the sample size are:

• C = the number of corrupt counts that could cause an incorrect election outcome is ‘‘=(N*(w-r))/(k*(b+w-r))’’.
• S = the audit sample size needed to detect, with probability P, one or more corrupt vote counts if there are C corrupt vote counts is ‘‘=N*(1-(1-P)^(1/C))’’.

For PROP 1A in the November 2008 Election

Parameter	Description	Value
N	auditable precincts or batches	1697
b	number of ballots cast	1245947
K	maximum margin detectable without an audit	40.00%
P	Confidence level	99.00%
w	winner vote count	592692
r	runner-up vote count	560342
C	number of corrupt precincts that could change the election = (N*(w-r))/(k*(b+w-r))	107.37
S	Sample size needed to detect C precincts changed = N*(1-(1-P)^(1/C))	71.25
	Sample size rounded up	72
	Audit sample percent	4.24%

Therefore, we settled on sampling 5% of the precincts, or 85 instead of the minimal 72 precincts as determined by the statistics. (Note that the 1% Post Election Manual Tally sample size of 17 precincts is insufficient to detect such errors to any reasonable confidence level. See Issue A045 - "PEMT Sample Size Insufficient.")

Random Selection of 85 Precincts

The precincts were chosen by selecting four-digit random numbers from a random number table and keeping values between 1 and 1650 inclusive. The random number table was from William H. Beyer, Ph.D. CRC Standard Mathematical Tables, 25th Edition, CRC Press (1978){{https://copswiki.org/Common/M880 William H. Beyer, Ph.D. CRC Standard Mathematical Tables, 25th Edition, CRC Press (1978) - using 'A Table of 14,000 Random Digits' (p 545-548)}} using 'A Table of 14,000 Random Digits' (p 545-548) and using the following procedure:

1. Start at the first digit in the table
2. Consider the next four digits.
3. If the numerical value of the four digits is outside the range from 1 to 1650, inclusive, continue at step 2.
4. If the number has been chosen before, continue at step 2.
5. Accept the number as a precinct number in the random sample.
6. Continue from step 2 until 68 precincts have been chosen.

These 68 randomly chosen precincts are combined with the 1% sample processed in the "One-Percent Manual Tally" procedure (17 precincts) conducted by the Ro V to result in a total of 85 precincts in the sample.

Note:

• After completing our review, we suggest that ten-sided die be used, and the die rolled again if the precinct is from a collection center that was already sampled. In the procedure above, many collection centers were sampled more than once with one sampled five times. (See Issue A035 - "PEMT Random Selection Not Technically Correct" for the recommended procedure.)
• The actual number of precincts was 1697, according to Collection Center Logs.

Data Collection

%IMAGE{"example_of_overprinting.jpg" type="frame" align="right" caption="An example of overprinting, effectively making the tape unreadable for this race and there is no other record for oversight review." size="300x300"}%

• We were only able to gather documentation on ballots processed on election night, including the 1% sample in the Ro V Post Election Manual Tally ("PEMT") and another 4% randomly selected. It was not possible to gather data on VBM ballots or provisional ballots because these are directly scanned into the central tabulator and do not provide a paper trail.
• The Scanner Tapes were scanned by COPs volunteers for all precincts in the sample and posted on our web site. Volunteers entered the data into web-based forms from the scanned tape files so that we could determine how many ballots were scanned for each precinct and could determine the voted result of the election if only those ballots are considered.
• Scanned the Ballot Statements for all 85 precincts in our random sample with signatures of precinct workers redacted. This was performed by the Ro V, and then we posted these statements for the public to review.
• Scanned the Street Indexes for about half of the precincts in our sample. These were not useful from a paper-trail standpoint because they were not always completed by the precinct workers in the 6pm to 8pm time period, thereby leaving off about 30% of the voters. Some of the ballot counts from the Street Indexes were added to our database, but we did not process all of them when we realized that they were incomplete.
• Other related documents were also scanned.
• We manually inspected sign-in rosters in about half the sample precincts. We were unable to scan these because the Ro V said it was a violation of privacy of the voters signatures. We found almost no discrepancies in the count of signatures on the sign-in rosters and what was reported in the Ballot Statements.

Precinct Data

The web page All Precincts provides results of our data collection activity for all the precincts in our 5% sample. Details and supporting documents can be viewed for each precinct by clicking on the precinct number.

Races

We also tabulated the results of races in the election, based on the vote from our 5% sample. The web page All Races provides a link to a separate page for each race in the election and lists the vote count from each precinct in the 5% sample. At the date of this writing, additional review of the data used in the races is required before we are confident of the reliability of these data. In many cases, the exact count was not available from some precincts because the tape was unreadable or the scan was defective. Readers who may be interested in specific races are encouraged to join our review effort and work to validate the count based on the scans of the scanner tapes.

Because of the other issues we detected in our review, we did not attempt to check the exact count to see if it matched the report from the Ro V, although that is our logical next step in the review. Such a comparison could detect some types of election fraud such as count rigging by the central tabulator operator.

Issues of Concern specific to this process

• Issue A002: Public Posting of Audit Trail -- The paper audit trail should be posted on the Internet on election night by elections officials so anyone can review it.

• Issue A024: Scanner Tapes Not Accessible
  Scanner report tapes are no longer available early in the canvass.

• Issue A025: Scanner Tapes Difficult to Process
  The audit trail provided by the current Ro V procedures include cash-register style paper tape which is difficult to process and sometimes impossible to read.

• Issue A009: Ballot Statements Not Scannable
  Ballot Statements must be scannable in their entirety, including signatures of precinct workers who sign them.

• Issue A018: Audit Log Insufficient
  The audit record available from the GEMS Central Tabulator does not provide sufficient detail to reconstruct the election.

• Issue A023: Documents Automatically Processable
  Documents that are considered public, such as Ballot Statements, Street Indexes, and others should be automatically processable to minimize oversight costs.

• Issue A029: Audit Devices Should be Allowed
  If no improvement to the audit log is possible, then audit devices should be placed on the serial interface cables that supply data to the central tabulator to allow a log of all communication from all scanner and DRE equipment to the central tabulator.

Issues of Concern Overview

Based on our review of the November 2008 presidential election, the Issues of Concern are grouped into the following categories. Each will be considered in a separate section. Some specific Isssues of Concern are duplicated in separate sections, if they apply to more than one.

• Lack of Documentation - The most prominent concern is the lack of documentation concerning many of the procedures in use. This section also details official reports that are insufficient or nonexistent.

• Chain of Custody - The Ro V does a poor job of tracking and investigating tampering (99 cases of tampering with no investigation). There are two subcategories, the chain of custody prior to the Tally Center, and the VBM Custody.

• Ballot Handling and Scanning - The number of signatures does not match the number of ballots scanned (off by 9,000 ballots).

• Audit Log Discrepancies - Audit log is insufficient and contains unexplained inconsistencies.

• Manual Tally Procedure - Post Election Manual Tally documents that 29% of precincts checked had errors, but they were simply rescanned and deemed fine, when the proper conclusion was that there are serious errors in the election.

• Audit Trail - We had difficulty in examining the entire election because the audit trail is insufficient, difficult to process, and only available after the election has been certified.

Note:
A number of issues we describe below occur during operations in precincts by precinct volunteers. We DO NOT regard these errors to be due to any fraudulent intent by those workers, but instead by procedures that require improvement. For example, very few precincts (only about 15%) were able to balance the number of ballots received with the number of signatures. We found that the form used and the method of reconciling could be improved to make it feasible for workers who are tired and ready to end their day of service to find the reason the counts do not reconcile. Given additional resources, additional personnel could assist with ballot reconciliation, related documentation and packing/sealing/transporting ballot cartons to the Collection Centers. A workflow analysis may reveal ways to improve and expedite procedures used in the polling place to address this issue.

Policy and Procedures Documentation Lacking

The Ro V is responsible for processing our election without undue error. The first step in a high-quality result, supported by all quality assurance methodologies, is to establish a full set of comprehensive documentation on the procedures and policies used by the Ro V to manage the election process and complete the canvass. Such documentation has been requested by members of our group and unless the Ro V is in violation the CPRA, we must assume that it does not exist. The processing of our elections should not be considered an ad-hoc or private matter. All steps should be observable and verifiable by oversight groups.

An established set of policies and procedures is fundamental to improve the quality of any operation. This should be the first order of business for all Ro V locations and mandated by law.

In addition to policy and procedure documents, working documents that detail the results of the election must also be available. This issue is dealt with in the issues category, "Audit Trail."

Issues related to this category:

Issue A001 - Lack of Comprehensive Procedure Documentation

Ro V does not maintain any comprehensive policy and procedures documentation. COPs requested such documentation on a number of occasions but was not successful in obtaining any comprehensive documentation for election procedures.

Comprehensive policy and procedures documentation is the first step to achieving high quality standards, as required by quality management standards such as ISO-9004-2 (2000) "Quality Management and Quality System Elements - Part 2: Guidelines for Services" as used in private industry. The lack of written policies and procedures by the San Diego County Ro V is a significant deficiency that underscores that local and state government institutions lack any legitimate quality management system standards equivalent to those used by private industry. The lack of standards denies citizens the ability to review and understand election processes used and the ability to hold public officials accountable when those standards are not met.

The two most important requirements of such a quality management system are:

1. documented policies and procedures and
2. a methodology to continuously improve the quality of the products and services provided. (i.e. a method to modify the procedures)

There was inadequate or nonexistent documentation for (at least) the following procedures:

• Supply Pickup Weekend (SPUW)
• Blank Ballot Inventory Verification
• "Office Use" section of Ballot Statement (See Issue A008 - Ballot Statements - Office Use Section Not Explained)
• Collection Center operation
• Tally Center operations
  • Incoming Inspection
  • Memory Card Pairing
  • Scanning
  • Memory card Reading
• Processing of VBMs & Provisionals
• Reconciliation Procedure (See Issue A026 - No Reconciliation Procedure)

• Issue A001: Question to Ro V
  The section Reference Documents lists all the policy and procedure documentation provided to use by the Ro V to date. Does the Ro V have any additional documentation of procedures used, including comprehensive policy and procedure documentation?

• Issue A001: Legislative
  ISO-9004-2 describes a quality management system for services, and can be effectively applied to services provided by governmental institutions, and election processing department, such as the Registrar of Voters. The Legislature should consider specifying the use of ISO-9004-2 as a basis for improving the quality of service and/or ISO-9001 (quality management system for products) for use by election juridictions.

Issue A003 - Citizens' questions not being answered

Citizens' questions not being answered -- Elections Code section 2300, the Voter’s Bill of Rights, requires elections officials to answer question from voters. Elections officials do not answer questions in writing from oversight activities in a timely fashion.

Elections officials often state "That's not a California Public Records Act Request" or "We don't have any document prepared that addresses that question, and therefore we won't answer it." These responses ignore section 2300 and do nothing to assist oversight groups in their activities. Such responses also ignore the Ro V’s own mission statement{{The Ro V mission statement says 'Conduct voter registration and voting processes with the highest level of professional election standards, accountability, security and integrity, thereby earning and maintaining public confidence in the electoral process.'}} professing a commitment to “earning and maintaining public confidence in the electoral process.”

• Issue A003: Proposal to Ro V
  All questions without attempting to subvert oversight using irrelevant or inaccurate references to the CPRA, without ignoring Election Code section 2300 and without ignoring the Ro V's mission statement.

• Issue A003: Legislative
  Elections Officials should be required to answer reasonable questions from oversight groups in a timely fashion, and not resort to "that is not a CPRA request."

Issue A008 - Ballot Statements - Office Use Section Not Explained

BallotStatements have an "Office Use Only" section does not include an explanation to allow the public to understand how it is being used.

The processing of our elections should be observable and subject to citizens' documentation in an open process with no secrets. The "Office Use" section could be easily explained on the Ballot Statement form. The Ro V should explain the use of this section and make that explanation available for anyone to read.

• Issue A008: Proposal to Ro V
  Explain the office use section on Ballot Statements and add this explanation to procedure documentation available to the public. The addition of titles to each field in the office use section is a first step to eliminating the mystery of this section of the form.

• Issue A008 Legislative
  Our election officials should run an open process that is available for the public to inspect. Secret "office use only" sections must be avoided in forms and if they are used, how the section is used by elections officials must be explained. This issue can be rectified if the elections officials maintains comprehensive procedure documentation (See Issue A001)

Issue A026 - No Reconciliation Procedure

Although the Ro V goes through a lengthy process of reconciliation which has been referenced in many conversations with them, this process is not documented in any procedure document. There are many re-scans of precincts all the way to the very last day of the canvass period, but as mentioned, no notes as to why these re-scanning operations are being performed. With no written procedure, no notes kept, and no final report, the electorate cannot verify that the canvass is in fact completed from a technical standpoint and has produced a reliable result.

Our review of the AuditLog revealed 133 times that the Registrar re-scanned precincts prior to the certification of the election (See "Audit Log Discrepancies" for our detailed discussion of this issue), but there is no written procedure supporting the decision process for performing such rescans, nor any way to document that all required rescans have been performed.

Furthermore, we see evidence that many ballots (about 9,000) are removed from the process and handled in another undocumented process and there is no tracking or reconciliation of those ballots (Issue A014 - "Tally Center - Write-Ins Removed and Not Counted".)

“Reconciliation” is the act of making two or more apparently conflicting things compatible or consistent with each other. The first step of reconciliation simply deals with the count of ballots, to insure that none are missed.

The following figures should all match (or an explanation regarding how they are reconciled should be provided):

• The number of nonprovisional and nontouch-screen signatures on the Sign-In Rosters.
• The count of physical ballots in the ballot box at the end of election night.
• The number "cards cast", as reported on scanner tapes.
• The number "# CARDS", as reported by the audit log for that precinct.
• The number "Ballots cast, Polling", as reported in the final canvass report.

The next step would be to check that the actual vote is correct. The Post-Election Manual Tally is an attempt to check this, but as mentioned in our review of that procedure (See "Manual Tally Procedure") 29% of the precincts show issues, and there is a claim that the reconciliation process will deal with those errors.

In order to resolve conflicts in election results, a “correct” result must be known. Correct results require an audit. No audit is possible because in order to audit an election, the auditor must be able to trace each vote to the voter who cast it. Because ballots are cast anonymously, no such trace is possible. Without knowing what the correct result is, the only reconciliation that is possible is one that resolves inconsistencies in a way that simply eliminates them. Elections officials have proven over and over again that they will always resolve inconsistencies in favor of eliminating questions about the integrity of the results regardless of whether the inconsistencies are actually evidence of fraud.

Even if officials intended to use a reconciliation process to uncover fraud, such a process does not reveal fraud in a timely manner. But, the time any evidence of fraud has been investigated, the media have anointed the winners. Experience has shown that reversing the outcome of an election after the “winner” is anointed is, for all practical purposes, impossible.

Therefore, a robust reconciliation procedure and the related reconciliation report Issue A028 - "No Reconciliation Report" to reduce doubts of the public, reduce the possibility of fraud, and provide a truly reliable certified election.

• Issue A026: Question to Ro V
  Please provide the procedure documentation for the "reconciliation procedure" which is used to determine if the election is complete and no additional rescans need to be performed.

• Issue A026: Legislative
  The Ro V uses a "reconciliation procedure" that is undocumented. This "seat of the pants" approach must be discontinued and a fully disclosed and documented procedure introduced with extensive notes taken along the way. Every rescan should be done for a reason, and the reason should be reviewed for possible improvement of the procedure. Without a written procedure and without any exception documents, it is impossible to feel confident that the canvass is complete, it is impossible to know if the procedure needs to be improved, and there is no path of action to improve the procedure.

Issue A032 - Archival Procedures Lacking

There are no check-in and check-out procedures in the secure archive area and only documentation describing where the materials are in the storage facility. There is no way to know who accessed the records to determine if any may have been modified. There are no seal serial numbers maintained on the documentation.

See also Issue A001:"Lack of Comprehensive Procedure Documentation".

• Issue A032: Question to Ro V
  Please establish rigorous check-in and check-out procedures for material in secure areas. There is no way to know who accessed the records to determine if any have been modified.

• Issue A032: Legislative
  Law should be improved to establish basic requirements for secure archival operation, to include at least:
  • Check-in and Check out procedures to document who has accessed the materials.
  • Serial numbers of any security seals used in the operation of the secure archive.
  • Closed-circuit TV recording, video archival, and review procedures.

Official Reports - Missing, Insufficient or Misleading

In addition to inadequate policy and procedures documentation, the official reports generated by the Ro V are frequently misleading, insufficient, or incorrect.

Issue A013 - Tally Center Reception Count Misleading

The count of precincts that have been received by the Tally Center on election night is frequently cited by news media as the number of "Precincts Reporting." However, the ballots may not be even counted yet, and there are a vast number of VBM, provisionals, write-ins, etc. that have not been processed either. Therefore, this number should not be made public. Instead, the figure should be the total number of ballots scanned and accumulated in the central tabulator divided by the total number of ballots received both on election night and as VBM ballots. Also see (See Issue A007: "Ballot Statements - Removed Write-ins Not Documented" regarding the removed write-in and damaged ballots that are not included in the count until much later.

• Issue A013: Proposal to Ro V
  Discontinue using the "Precincts Reporting" figure and clearly state the significance of the number reported. The figure cited should be the total number of scanned and tabulated ballots divided by the total number of ballots received, both those received on election night and those received as VBM ballots. The Ro V should disclose that the "precincts reporting" figure is no longer used because it is not an accurate representation of the completion status of the election.

• Issue A013: Legislative
  Mandate that the Ro V should discontinue using the "Precincts Reporting" figure and instead cite a completion figure based on the total number of scanned and tabulated ballots divided by the total number of ballots received, both those received on election night and those received as VBM ballots.

Issue A028 - No Reconciliation Report

A reconciliation report should be provided that includes an explanation for any irregularities and provides a means to document that the canvass is complete. This report should show the number of sign-in signatures, the number of ballots scanned and tallied, the number of provisional ballots accepted and rejected, the number of VBM ballots received at the precinct and the number processed, etc. such that the figures shown above all balance. This report has been mentioned by the Ro V but it apparently does not exist. See also Issue A026: No Reconciliation Procedure.

• Issue A028: Question to Ro V
  Please explain the crashes and program errors encountered by the central tabulator in the November 2008 election with possible assistance by the vendor (Premier Election Solutions in this case).

• Issue A028: Legislative
  It should be statutory that crashes and program errors reported in the audit log are described and resolved in the final canvass report without the need for oversight groups to make requests to have these explained. The reconciliation report is a logical place for these explanations.

Related Issues of Concern
The following Issues of Concern are related to this category but have more relevance to other categories. They will be expanded in full in those categories and are only briefly mentioned here to avoid redundancy.

• Issue A002: Public Posting of Audit Trail -- The paper audit trail should be posted on the Internet on election night by elections officials so anyone can review it.

• Issue A004: No Ballot Inventory Report -- No report is generated regarding whether any errors occurred during SPUW, including the count of ballots.

• Issue A031: No Seal Tampering Report
  At present there is no report explaining tampered seals.

• Issue A040: PEMT Reports Incomplete
  The PEMT should produce a report for every race and every precinct, as suggested by the So S.

Chain of Custody

Chain of Custody Overview

The term "chain of custody" is most commonly used with regard to legal evidence. Chain of custody refers to the chronological documentation, and/or paper trail, showing the seizure, custody, control, transfer, analysis, and disposition of evidence, physical or electronic. In elections, it refers to the active control asserted by the Ro V over blank and voted paper ballots, sealed ballot boxes or ballot cartons, electronic media, and other documents related to the execution of the canvass.

Robust ballot accounting and secure chain of custody of election materials and equipment are prerequisites for accurate election results and post-election audits. The following conditions must be met:

1. There are strict written accounting procedures for paper records to prevent the addition, subtraction, substitution, or alteration of paper records.
   • Durable Paper Ballots are used as the primary Cast Vote Record (CVR).
   • Blank ballots must be strictly controlled to avoid ballot substitutions.
2. To safeguard the ballots and audit records from loss and tampering, paper records and electronic equipment are fully secured at all times when a breach could adversely affect the integrity of the records including from the time the votes are cast until all audit or recount activity is completed and election results are finalized, including the expiration of all legal recourse to challenge or correct the election.
   • Procedures regulating access to ballots and equipment could include requiring signatures for access and documenting the reason for it, preventing access by a single person, requiring that access be observed by members of opposing parties, or the use of surveillance cameras to guard storage areas.
3. An audit of these procedures should begin as soon as possible after the random selection of audit units, which commences as soon as possible after the initial tallies recorded by the voting system are reported, the audit conducted by an independent group of analysts.
4. The secrecy of the ballot is preserved.
   • It must not be possible to determine how a person voted by inspecting election records (although those records do document whether the voter voted in the election.)
   • The order of the votes cast is never compared to the order in which the voters signed in.
   • Each ballot, although it may be identified with a unique identifier, must not be connected to the identity of the voter.
5. There is a reconciliation to ensure that all votes from all audit units are correctly tabulated in the election totals.

Because of the reliance upon the durable paper ballot coupled with the fact that these ballots are not fully imaged and archived on digital media (as is proposed by the Open Canvass Method), chain of custody is a concern during nearly every procedure. However, we use the term here to mean the chain of custody prior to the Tally Center, and with regard to VBM ballot handling.

Chain of Custody - Pre-Tally Center

The first subcategory of issues in the Chain of Custody has to do with the control of ballots, blank and voted, distributed to the precincts and before they reach the Tally Center. The Ro V uses tamper evident seals in an attempt to impose strict control on blank and voted ballots.

The use of tamper evident seals is now common in industry and the best practice for use of these seals is as follows:

1. Strict custody of all seals is necessary.
2. All seals have unalterable serial numbers.
3. A trusted person must have custody of some subset of the seals distributed for use. The serial numbers distributed to that person must be documented.
4. The trusted inspector must inspect the item to be sealed, and preferably, witnessed by a second person. The serial number of the seal is then documented by the trusted inspector in separate documents.
5. If the item must be opened and resealed, this must be documented as well, including the serial numbers of the old and new seals.
6. All remaining seals must be returned.
7. At each stage of inspection of the item, the seal number should be checked to validate that the seal has not been changed, and any evident tampering must be documented immediately.
8. The documentation must be maintained securely to allow checking the serial numbers of the seals. There is an implicit assumption that the chain of custody of the documentation is more secure than the chain of custody of the seals items.

Unfortunately, the Ro V does not follow the elements of these best practices, making the use of these seals nothing more than a sham.

The chain of custody of important documents by the San Diego Registrar of Voters is extremely lax and in need of improvement. This issue is severe and may be negligent or criminal. There is no sense in using tamper evident seals on ballot cartons if there is no investigation of tampering when there is such evidence in 99 cases. Similarly, we are told that the entire facility is under observation by closed-circuit video camera. However, the Ro V did not provide any documented procedures regarding review of the video camera evidence. Therefore, these procedures are nothing more than shams. "The whole place is under video surveillance" means nothing if no one watches the video. "We use tamper-evident seals" means nothing if evidence of tampering is clear and yet goes without consequence and there is no investigation or explanation.

The Ro V must be required to produce a comprehensive chain-of-custody report including rationale for every broken and irregular tamper-evident seal. At this point, there is some logging of seals but no serial numbers, and then no report on the whole situation.

Issues of Concern related to Pre-Tally Center Chain of Custody

Issue A004 - No Ballot Inventory Report

No report is generated regarding whether any errors occurred during SPUW, including the count of ballots.

• Issue A004: Proposal to Ro V
  Create and provide, in the normal course of business, a Ballot Inventory Report, regarding whether any errors occurred during SPUW.

• Issue A004: Legislative
  Make creation of a "Ballot Inventory Report" mandatory, regarding whether any errors occurred during Supply Pickup Weekend, including the count of blank ballots and why any errors occurred, and how these errors can be rectified in the future.

Issue A005 - No Seal Serial Number on Ballot Statements

Serial numbers of the tamper-evident seals are not included on Ballot Statements. Using tamper evident seals with serial numbers and documenting those serial numbers in companion documentation is a requirement for a legitimate seal management strategy.

• Issue A005: Proposal to Ro V
  Include seal serial numbers on ballot statements and add a procedure to note the serial numbers of all seals used on ballot cartons and elsewhere.

• Issue A005: Legislative
  Recording of serial number of any tamper evident seals must be made mandatory. For San Diego, seal serial numbers should be recorded on ballot statements. Also, included in the comprehensive procedure documentation must be a procedure to note the serial numbers of all seals used on ballot cartons and anywhere else, and a procedure to investigate seals that show tampering.

Issue A012 - Collection Center Seal Logs Lack Serial Numbers

Authorized personnel at Collection Centers are required to inspect the tamper-evident seals, but there is no place on the log sheet to document the seal numbers nor to note whether the seals were intact. Collection Center Logs documented only 6 tampered seals while 99 tampered seals were later detected at the Tally Center. Documenting serial numbers of seals is a requirement for a legitimate seal management strategy.

• Issue A012: Proposal to Ro V
  Improve the chain of custody of the ballots. Collection Center personnel must be required to inspect all ballot boxes received from the precincts. Security seals must be confirmed to be properly affixed and without evidence of tampering before precinct workers are relieved of their duties. Each inspection must be reported in writing to indicate the precinct and seal number for each box, the names of persons delivering the ballots, that the inspection was performed, that the box and seal is intact and without evidence of tampering. No precinct worker may be relieved of his or her duties until the collection center personnel are satisfied that the box is properly sealed and the report in writing is completed. Automated bar-code scanners can expedite the collection of seal serial numbers.

• Issue A012: Legislative
  Mandate that chain of custody reports at collection centers include status and serial numbers of all security seals (and the process described above).

Issue A016 - Tally Center - 99 Seals broken or wrong

In the November 2008 election, Tally Center Logs document 99 precincts that had wrong or broken seals, a 6% rate, and there was no investigation. There were no exception documents provided for our review describing why the seals were incorrect or broken. Seal documents do not include a serial number. Only a cursory inspection was performed by elections officials, and there was no attempt to validate the count of ballots as reported by the precinct. Why was it the case that 99 seals were detected as wrong or broken at the Tally Center while only six were detected by the Collection Centers? Documenting serial numbers of seals is a requirement for a legitimate seal management strategy.

• Issue A016: Question to Ro V
  Why was it the case that 99 seals were detected as wrong or broken at the Tally Center while only six were detected by the Collection Centers?

• Issue A016: Legislative
  Election law must explicitly lay out the requirements for implementing a legitimate strategy and mandate compliance. It is not enough to use security seals. Implementing a legitimate security strategy requires that the security seals each have a serial number and that these are recorded at each step of the process. In San Diego, 6% of the seals were noted as tampered or wrong, but there was no investigation or report, and there was no tracking of serial numbers. If serial numbers are not tracked, there is no way to detect if a security seal is replaced with another seal after tampering.

Issue A031 - No Seal Tampering Report

A seal report should be generated that explains all tampered seals. At present 99 seals show tampering but there is no report documenting an explanation if any from those responsible for chain of custody, what action was taken to investigate the irregularities and eliminate the tampering. It is negligent to simply report the number of seals that were broken or incorrect and take no action. The report should also explain why the tampering occurred and how it can be eliminated in the future. Evidence that 99 seals showed tampering is stunning considering particularly in light of the lack of follow-up or explanation. Also, since no serial numbers are recorded, the number of tampered seals may be much larger.

• Issue A031: Proposal to Ro V
  Please produce a seal tampering report for the November 2008 election which explains all tampering evidence.

• Issue A031: Legislative
  Elections officials should be required to prepare a seal tampering report to include at least the following:
  • Enumeration of each seal broken, incorrect, or missing.
  • Explanation regarding why each seal was tampered.
  • Changes to procedure proposed to reduce false positive detections of tampering.
  • Notices of termination of workers responsible for tampering.

Issue A011 - Spoiled Ballots Loosely Controlled

Spoiled Ballots, both VBM and election day are not under strict control. I.e. it would be a simple matter to checkmark a VBM envelope to indicate that the ballot was spoiled and eliminate it from consideration, and to covertly redo a vote and show a spoiled ballot at the polling place. To "spoil" a ballot, it should require the signature of the voter. Anyone could checkmark a VBM ballot as spoiled, and easily disenfranchise a voter. All spoiled ballots should be tracked to confirm that an unspoiled ballot is completed by the voter.

• Issue A011: Proposal to Ro V
  Modify procedure to tightly control spoiled ballots.

• Issue A011: Legislative
  Mandate that elections officials maintain records of spoiled ballots to allow confirmation that a non-spoiled ballot was eventually turned in, and to avoid the possibility of disenfranchisement by a compromised elections official who could simply checkmark "spoiled" on target ballots.

Advisory Issues related to elements of our project which can be enhanced.

• Issue C002: Ballot Order Chain of Custody
  We did not review the process of maintaining control of blank ballots and reconciliation at the precinct level. There is a concern regarding chain of custody of blank ballots. Is there a vulnerability to fraud based on accessing blank ballots and then removing and replacing completed ballots with those blank ballots which have been cast illegally?

• Issue C003: SPUW Not Witnessed by COPs
  Supply pickup weekend not witnessed nor video recorded.

• Issue C005: Collection Center Activities not Observed by COPs
  We did not witness nor record activities at any collection centers.

• Issue C006: Tally Center Incoming Reception Observation
  We witnessed Tally Center Incoming Reception but did not video record it directly.

• Issue C007: VBM & Provisional Process Witnessing
  The Vote-By-Mail and Provisional Ballot Processing procedure was not recorded on video and our description was generated solely through Q&A with Ro V staff.

---

Chain of Custody – VBM Custody

The second subcategory of Chain of Custody issues has to do with the custody and control of Vote-by-Mail (VBM) (and provisional) ballots.

Issue A010 - VBM Ballots Not Logged at Precinct

VBM Ballots were not logged, counted, or reported by the precinct. It is not necessary to sign anything to drop off your VBM ballot at the precinct or Ro V office, and this is a deficiency.

• Issue A010: Proposal to Ro V
  VBM ballots should be counted and logged when dropped off at the Ro V office or at precinct locations and placed in sealed containers. The ballot statement should include the count of VBM ballots being returned, and this count should be checked at the Tally Center when they are received.

• Issue A010: Legislative
  Improve elections code to mandate logging of VBM Ballots dropped off at precinct locations, and require that they are counted, logged, and reported, and placed in sealed containers to avoid tampering.

Issue A020 - No Log of changes to the Election Management System

The Election Management Systems is updated when a VBM ballot is received. However, there is no audit log of each transaction. A transaction log of VBM and provisional ballots must be made available for inspection. At this time, we are not aware of such a log. The Voter Data File is modified directly with no audit trail that can be inspected. If we had such an audit log, we could reconstruct the number of ballots actually received and compare that with the number of ballots scanned and entered into the central tabulator. At present, due to this lack of paper trail, such oversight is impossible.

• Issue A020: Question to Ro V
  Confirm that no audit log exists that documents each change to the Election Management System when each VBM ballot is received for the November 2008 election. Provide such a log in future elections.

• Issue A020: Legislative
  The Audit Log should include entries for each VBM ballot as it is received so that it is possible to determine if all ballots have been scanned. This is equivalent to the Ballot Statement for precinct ballots, but for VBM ballots. A robust audit log (Issue A018) should include this aspect.

Issue A021 - VBM Ballots are not counted

(Issue A021, Issue A022, and Issue A030 all treated under here because of their similarity and overlap.
VBM Ballots are not counted after being removed from the envelope and before submitting for scanning, and there is no attempt to confirm the count of ballots as they are scanned.

We recommend the following procedure:

• When VBM and Provisionals are initially processed, the Voter Data Record is updated.
• Envelopes are sorted by precinct.
• Process ballots in batches. Maintain a count of ballots processed at each step.
• Maintain a chain of custody document that travels with each batch (a "traveler") that documents the number of ballots in the batch.
• The operator of the scanner should first zero the count of ballots scanned, and then proceed to scan the batch.
• The operator proceeds to scan the batch, and produce a report tape.
• If the count scanned (scanner report) does not match the number of ballots in the batch (on the traveler), the discrepancy should be documented and the batch recounted and/or rescanned until the discrepancy is resolved.
• When the ballot counts match, the batch is approved by the operator, and the totals sent to the central tabulator for accumulation.
• The audit log should document the exact number of ballots processed in the batch and the total votes in each race processed.
• The scanner report tape, and memory card, if applicable, should be archived for inspection by oversight activities.

• Issue A021: Question to Ro V
  To maintain positive control of VBM ballots, it would be preferable to determine the total count of ballots to be scanned based on the number originally submitted, and then check the total number scanned as reported by the scanner. This should reduce the number of rescans necessary during the canvass period, should reduce errors, and should result in lower overall cost to process the VBM ballots. See the procedure above.

• Issue A021: Legislative
  Elections officials should be required to document control of the chain of custody as ballots are transported and counted, meaning that the count of ballots in batch boxes are documented in associated "traveler" documents. This allows workers and citizen oversight groups to verify that the number of ballots scanned exactly matches the count submitted, as well as allowing rapid correction of errors. See the procedure above.

Issue A022 - VBM Ballots not precounted during scanning

We were told that the scanner operator pre-counts the ballots as they run them, but this did not occur. See Issue A021: "VBM Ballots are not counted."

Issue A030 - No Paper Trail for VBM and Provisionals

Unlike ballots processed on election night, no scanner reports are produced and ballots are read directly into the central tabulator. VBM ballots and provisionals should be scanned by scanners that produce a report, so these can be accessed later. (May be avoided if the audit log is improved and available.)

This has been combined with Issue A021: VBM Ballots are not counted.

Ballot Control and Scanning

The first step of our review is to determine if all the ballots were correctly processed.

Acceptable Error Rate

Voluntary Voting Systems Guidelines were authored by the Technical Guidelines Development Committee (TGDC), a committee authorized under the HELP America Vote Act (HAVA) of 2002, and researchers at the National Institute of Standards and Technology (NIST) for the Election Assistance Commission (EAC). These guidelines were authored primarily to guide voting machine manufacturers in their design of voting systems.

They were recently modified to require a vote-capture device that uses independent voter-verifiable records (IVVR). For example, durable paper ballots that are scanned represents a record that can be easily read by the voter and interpreted by machines, the "Cast Vote Record" (CVR).

This document also describes acceptable error rates. In particular, it defines "disenfranchisement" (Section 6.3.1.3 "Manageable failures per election") as follows:

Any failure that results in all CVRs pertaining to a given ballot becoming unusable or that makes it impossible to determine whether or not a ballot was cast is called disenfranchisement. It is unacceptable for even one ballot to become unrecoverable or to end up in an unknown state. For example, an optical scanner that shreds a paper ballot, rendering it unreadable by human or machine, is assessed a disenfranchisement type failure; so is a DRE that is observed to "freeze," providing no evidence one way or the other whether the ballot was cast, when the voter attempts to cast the ballot.

The guidelines suggest that no error in terms of disenfranchisement is acceptable (error rate=0), and that the central tabulator would exhibit an error rate of 1.237×10^-6, that is, one lost ballot in 808,407 ballots cast. In San Diego, with 1,245,947 ballots cast in November 2008, we would expect no more than 1.54 ballots to be lost due to central tabulation error. This can be rounded up to 2, i.e. the election system in San Diego County, according to the federal guidelines, should lose no more than 2 ballots in the November, 2008, election.

Although the Election Assistance Commission states that there should be zero error rate with regard to disenfranchisement, this requirement, although desired, is not feasible in any real system. Therefore, for the purposes of our analysis, we will use the higher error rate suggested as the maximum for central tabulation, i.e. 2 ballots lost. If we combine the two limits, for the County of San Diego, we are limited to four ballots lost.

The question of disenfranchisement is whether every voter who submits a valid ballot has their vote counted, not whether their vote was counted correctly. Disenfranchisement can occur when elections equipment skips ballots (i.e. misfeeds) and there is no correction or if ballots are lost or stolen, for example. It might be argued that random disenfranchisement will not change the outcome of the election since any truly random change will average out to no change. However, this is absolutely not the statement by the Election Assistance Commission guidelines, which explicitly state that every vote must be counted, and no ballots should be disregarded.

Method of Analysis

The question "were all ballots counted" does not consider whether the vote is counted correctly from those ballots, but simply that every ballot that is cast is attempted to be counted and is not lost in the shuffle. This must always be our first order of business in reviewing any vote counting operation.

To determine the performance of the San Diego County Ro V in this regard, we reviewed data collected in our 5% sample regarding the number of ballots processed. The most significant figures are:

• The number of people who signed rosters at the polling place and who received paper ballots.
  • Total number of signatures is Reported on Ballot Statements and signatures can be counted on the sign-in rosters to verify those figures.
  • Number of paper ballots is the total number of signatures minus provisional voters and minus touchscreen machine voters.
• The number of ballots counted by precinct workers at the close of the polls
  • Reported on Ballot Statements
• The number of ballots scanned by scanner equipment at the Tally Center
  • Reported on Scanner Tapes as "Cards Cast"
• The number of ballots reported in the Audit Log of the central tabulator for each precinct.
  • From the Audit Log as "# CARDS"
• The number of ballots reported in the final canvass report by the Ro V
  • From Canvass Reports as "Cards Cast"

Issue Category I: Most Precincts Did Not Balance

This issue is handled by Issue of Concern Issue A006 - "Ballot Statements - Few balanced"

We were surprised to discover that very few precincts (15 = 17%) in our sample reported correctly reconciled the count of ballots with the number of signatures after their polling place closed. 83% of the precincts reported that their totals did not match the number of signatures on sign-in rosters, and most of those could not identify why the discrepancy occurred. See the column "Ballot Statement Notes" on All Precincts and look for "Yes", meaning that the count of signatures matched the count of ballots. Many precincts simply gave up and did not attempt to determine why the discrepancy occurred. Others reported that they were instructed to stop attempting reconciliation after several tries because, "they can fix it at headquarters."

The following counts and observations are relevant to this issue in our attempt to make sense of this disaster.

Blank Ballot Count
The count of blank ballots received by each polling place is determined by Ro V staff in preparation for Supply Pickup Weekend and documented on the Ballot Inventory Sheet. The Precinct Inspector counts the ballots received and confirms the count on the two-part Ballot Inventory Sheet. It is difficult to imagine that this count can be significantly in error with this two-step check. This count can be considered very reliable.

Counts for Voted, Spoiled, Unused, Provisional Ballots
Precinct workers are instructed to count voted, spoiled, unused, and provisional ballots after the polls close. Some reported in their comments that they counted ballots several times, although this is not specifically documented by the Ballot Statement form. In our analysis, we consdered these counts as "reliable" because counting ballots is not a difficult procedure.

Reliability of Sign-In Count
We counted the number of signatures on sign-in rosters by manually reviewing the rosters and making notations about the number of signatures on each page. We compared that figure with the number as reported on Ballot Statements.

We found:

• no significant variation between the count we made by inspecting sign-in rosters and that reported on Ballot Statements. This implies that this count is relatively reliable.
• Sometimes it was difficult to know if the signature existed or not, since some signed on top of the notation "Mail Ballot Received", some signatures are not much different from random markings, and some precincts added notations, such as lining-through some signatures in their counting process.
• that many precincts allowed VBM voters to sign over "Mail Ballot Received" if they had a mail ballot to surrender, and some allowed VBM voters who did not have a ballot to surrender to sign it as well.
• Many provisional voters did not sign the rosters.

Why Statements did not Reconcile
Given an expectation that the reported counts of signatures and ballots would be reasonably reliable, why did so few precincts balance?

• Voters did not sign the rosters - Although it is a requirement that voters sign the roster, some did not and still received a ballot. This was particularly true of provisional ballot voters.
• VBM voters signed the roster over the "M" or "Mail Ballot Received" designation. There was no place for VBM voters to sign if they had their ballot to surrender.
• VBM voters who just turned in their envelopes did not sign anything, so these were untrackable.
• VBM voters sometimes signed both the provisional roster and the white/blue/pink rosters if they did not have a ballot to surrender.
• Voters sometimes returned their ballot to the wrong precinct, in locations where multiple precincts were conducted in parallel.
• Ro V staff said it may be the case that voters left with their ballot and did not turn it in. However, this sounds like a very unusual case as it makes no sense for voters to come to the polling place and not vote.

Issue Category II: Many Ballots were not scanned

%IMAGE{"BallotStatement1563.jpg" type="frame" align="right" caption="Ballot Statement for Seq# 1563 documenting 565 ballots counted." size="300x300"}% %IMAGE{"ScannerTapeTop1563.jpg" type="frame" align="right" caption="Top of the Scanner tape for Seq# 1563 documenting only 550 ballots scanned -- 15 ballots lost." size="300x300"}%

This issue is handled by Issue of Concern Issue A044 - "Many Ballots Not Scanned"

Polling place workers count the number of ballots in their attempt to complete the Ballot Statement form and reconcile the numbers. Counting ballots seems like a relatively simple procedure particularly if repeated to check the count, as many polling places reported. It is likely that they counted multiple times mainly because they could not find the source of the reconciliation discrepancy.

However, when the number of ballots was compared with the number of "Cards Cast" from the scanner tapes, we found that 429 ballots were lost in our 5% sample. Extrapolating this over the entirety of the election, a total of over 9,000 ballots were lost, more than five per precinct on the average. Only 4 precincts had no apparent loss of ballots when they were scanned in our 85 precinct sample (4.7%).

To cite a clear example, consider Precinct Sequence 1563 which is one of the few Ballot Statements that reconciled completely. The precinct had no touchscreen ballots. The ballot statement discloses 565 ballots counted and that matches the number of non-provisional signatures (565). However, the scanner tape from the Tally Center says there were only 550 cards cast.

Therefore, 15 ballots were lost in this precinct alone.

What happened to the ballots:
We asked the Ro V this question and they refused to explain it, saying that it was not a record that could be provided in a California Public Records Request. We refuse to accept stonewalling, and would like to know what happened to these ballots, as this is the first step to producing a reliable canvass.

The options are:

• Ballots were never in the "voted" box - This would imply that workers in over 95% of the precincts cannot count the ballots and that they consistently miscount by missing ballots. Since we did not find any obvious deviation from the number of signatures on rosters and the counts provided by the precinct workers, the concept that they cannot count ballots is viewed as VERY UNLIKELY.

• Ballots were removed because they were "Write Ins" - At first glance, this seems to be likely, despite the fact that the scanner tapes include values for write-ins. If this is the case, then the removal of these ballots makes it very difficult to track lost ballots in the scanning process.
  
  The Post Election Manual Tally procedure detected errors and lost ballots in 29% of the precincts. The Ro V confirmed these errors when they reran the precincts through the scanners, magically finding the ballots. Instead of seeing this as confirmation of a serious problem, the Ro V said there was no problem at all because the rescan corrected it, and they refused to answer our question regarding where the ballots went. (See "Manual Tally Procedure").

• Ballots were misfed through the scanner, either accidentally or intentionally - This is a distinct possibility. The scanners were designed for one-at-a-time manual feeding. If an operator feeds them too quickly, they may skip a ballot, or if the operator sees a vote they do not like, they could skip the ballot and place it directly in the output tray. The Ro V confirmed that both of these were possibilities.

• Ballots are removed from the ballot box prior to scanning - 6% of the tamper-evident seals are either tampered with or incorrect and the tracking of these seals is minimal, with no followup. However, the number of precincts with tampering was not high enough to account for the large number of precincts with lost ballots (95%).

In C00022, the Ro V mentioned the fact that write-ins and damaged ballots were removed from the rest of the ballots and this may be the explanation for this discrepancy. However, there are no documents (that we are aware of) that track this or report on the number of write-ins and their disposition.

Issues of Concern related to Ballot control and scanning

Issue A006 - Ballot Statements - Few balanced

Only a few of the Ballot Statements had figures that balanced, and only one precinct had all the ballots correctly scanned. See Unscanned Ballots for a full analysis of this problem.

According to federal election guidelines, disenfranchisement of even one voter, or more than one lost ballot in 808,407 ballots cast due to equipment failure is not allowed. Tracking this problem starts with the sign-in rosters and Ballot Statements completed at the polling place.

Polling workers are volunteers and are not specifically suspect of malfeasance, but improved training and simplified reconciliation procedures should be established to minimize the discrepancies in the count of ballots.

• Issue A006: Proposal to Ro V
  
  Suggestions to Improve Ballot Statement Reliability
  • Avoid multiple-precinct polling locations or separate them more distinctly so it will be very unlikely that a voter would turn in ballots to the wrong precinct ballot box.
    • Simple ballot scanners that detect the precinct and will cause an alert if a voter attempts to deposit a ballot into the wrong ballot box could be used.
    • Scanners could also provide a machine count of the ballots.
  • Provide a worksheet to reconcile smaller aspects. Current reconciliation attempts to reconcile the total number of signatures with the total number of voted ballots.
    • Separately reconcile provisional ballots and provisional sign-in sheets.
    • Separate provisional ballots into two groups:
      • VBM voters who did not surrender their VBM ballots who are listed with that precinct
      • Other voters who are voting in the "wrong" precinct.
    • Subtract provisional and touchscreen voters from total signatures to determine total paper ballot signatures and reconcile that with the number of actual ballots.
  • Maintain sign-in rosters for ALL VBM ballots returned to each polling place.
    • Currently, separate sign-in rosters are not maintained for VBM voters who do not wish to vote in person.
    • Sign-in rosters will allow tracking the VBM ballots and provide a way to determine where in the system they are lost, if indeed they are.
  • Provide sign-in locations for VBM voters who are listed as members of the precinct and designate if mail ballot was surrendered or not. Those who do not surrender their mail ballot should also sign the provisional roster and obtain a provisional ballot. With this designation, duplicate signatures can be easily located.
    • Avoid the current practice of "signing over" the "MAIL BALLOT RECEIVED" designation in the signature box.
  • Avoid the practice of putting a line through the signature box, which some precincts did apparently to help count them.
  • Include a checkbox that can be marked by Precinct workers to designate that the scribble represents the voter's signature. Some signatures are so bad, they are hard to discriminate from random markings.
  • The Ro V should produce a report summarizing the count of signatures, the actual number of ballots returned, and an overall percentage of error. This report should be mandated by the So S. The Registrar should encourage precincts to do better (The registrar is required to compel the accounting per Election Code 14405: "(a) The members of the precinct board shall account for the ballots delivered to them by returning a sufficient number of unused ballots to make up, when added to the number of official ballots cast and the number of spoiled and canceled ballots returned, the number of ballots given to them. The officers receiving returned ballots shall compel this accounting.") Precincts that produce accurate reports that account for all signatures should be acknowledged with certificates of merit or other prizes. Similarly, those precincts that do not do well will need additional training or staffing changes so the failure does not repeat in the next election.

• Issue A006: Legislative
  (See Unscanned Ballots)

Issue A044 - Many Ballots Unscanned

When the number of ballots as counted by poll workers was compared with the number of "Cards Cast" from the scanner tapes, we found that 429 ballots were lost in our 5% sample. Extrapolating this over the entirety of the election, a total of over 9,000 ballots were lost, more than five per precinct on the average. Only 4 precincts had no apparent loss of ballots when they were scanned in our 85 precinct sample (4.7%). See Unscanned Ballots for a full discussion of this issue.

In addition to the related Issues of Concern: Issue A007 - "Ballot Statements - Removed Write-ins Not Documented", Issue A014 - "Tally Center - Write-Ins Removed and Not Counted", Issue A015 - "Tally Center - Damaged Ballots", and Issue A019 - "No Comparison of Ballot Count", it should be observed that the general strategy of the Ro V to count ballots is problematic.

Currently, the Ro V uses 150 hand-fed Diebold scanners and 150 volunteers feeding those scanners, likely because the Ro V already had purchased these scanners. It would be superior to use fewer high-speed automatic feeding scanners which are common in private industry today. This is the configuration suggested by the Elections Assistance Commission, and would likely vastly improve the throughput and reliability of the scanning process. This is the general direction suggested by the Open Canvass Proposal, where the ballots are simply scanned and turned into digital images before any vote recognition is attempted.

• Issue A044: Proposal to Ro V
  

It is critical that the Ro V address this issue, as losing 9,000 ballots is a serious concern in the election.

Please explain how and why there are so many ballots that are not scanned.

We recommend that you consider discontinue using the Diebold scanners that were originally designed for use in precincts and exhibit an excessive error rate. Instead, consider using high-throughput digital scanners with automatic page feeding capability. These commonly run at 100 to 200 pages per minute, instead of about 6 pages per minute with the existing scanners.

Since these scanners exhibit a failure rate far in excess of the guidelines of the Elections Assistance Commission, perhaps the manufacturer, Premier Election Solutions (formerly Diebold Systems) should provide corrections to their equipment or provide other equipment to reduce the failure rate.

• Issue A044: Legislative
  The number of unscanned ballots discovered in San Diego County Ro V is extremely distressing and if this is currently allowed by law, something is seriously wrong with our elections code. The Election Assistance Commission has provided a number of requirements for election equipment manufacturers. These requirements should be resolved to state law so that counties have recourse to demand that the equipment manufacturers provide solutions that meet those requirements or describe why it is technically impossible to meet them.

Issue A007 - Ballot Statements - Removed Write-ins Not Documented

BallotStatements did not include a count of the number of write-ins and damaged ballots removed. Precinct workers are requested to look through the ballots and remove all write-ins and damaged ballots and place these into a separate group, which is to be banded. The incoming inspection activity has two check-offs that relate to this: 1) write-ins removed and 2) write-ins banded. However, no one counts these so we know how many have been removed. This should be recorded on the BallotStatements. In addition, these ballots (nearly 9,000 ballots) are withheld and not processed for an extended period of time. During this time, the "precincts reporting" figure should not claim that the precinct has been fully reported.

• Issue A007: Proposal to Ro V
  Document the number of write-ins and damaged ballots and their disposition for all precincts in future elections. The Ballot Statement may be a good place to record the number. Until these ballots are included in the count, the "precinct reporting" figure should not be 100% (See Issue A013: Tally Center Reception Count Misleading.)

• Issue A007: Legislative
  Law should mandate that elections officials document the number of write-ins and damaged ballots and their disposition for all precincts in future elections. In addition, the "Precincts Reporting" figure released to the media, should not include any precincts that have not been fully counted, including the write-in ballots. (See Issue A013: Tally Center Reception Count Misleading.)

Issue A014 - Tally Center - Write-Ins Removed and Not Counted

At the Tally Center, write-in ballots are apparently removed permanently prior to scanning rather than scanned first and processed later or quickly processing and uniting them with the rest of the precinct. It makes reconciling the number of ballots problematic because there is no notation as to how many "write-ins" are removed nor what is done with them. Approximately 9,000 ballots appear to be removed at this point. The scanners do tally the number of write-ins and there are many write-ins that were noted on the scanner tapes. We consider this an open issue as we do not have adequate information to understand exactly what happened, and the number of ballots -- 9,000 -- is certainly significant. We are not sure how the write-in ballots, received on election day, are processed. Only 146 ballots were removed and documented as "damaged" and the balance of nearly 9,000 ballots removed at this point are not documented.

Ballots should not be taken from the boxes prior to scanning. Currently, many counts do not match (9,000+ ballots missing), but are magically corrected later. See [[#IssueA026}[Issue A026 - No Reconciliation Procedure]] for details on how this should be reconciled.

• Issue A014: Question to Ro V
  Why are write-in ballots removed prior to scanning rather than scanning first and processing later or quickly processing them and uniting them with the rest of the precinct. Is there any logging of the count of ballots removed in this manner for each precinct and the disposition of each one?

• Issue A014: Legislative
  Mandate that elections officials maintain a correct count of all ballots from each precinct and maintain these ballots as a group, without removing write-ins prior to scanning. Any ballots removed for inspection by elections officials should be logged. The precinct should be considered fully counted until these ballots are included in the count. The PEMT should included these ballots in the tally (They are not included now). The scanners in use by the Ro V can detect and report if a ballot has a write-in for a race, so there is no need to separate these in advance.

Issue A015 - Tally Center - Damaged Ballots

On the Tally Center Log sheet, there is a checkbox for "Damaged Removed." However, we don't know why any ballot would become damaged and not be treated as "spoiled." A spoiled ballot, by definition, is one that is filled out incorrectly or damaged and a new ballot is issued to the voter. Why would there be any ballots that are "damaged" and a new ballot not issued to the voter? However, 146 ballots were separated as "damaged" instead of "spoiled" in the November, 2008, election. (But another 9,000 ballots were removed as well.)

• Issue A015: Question to Ro V
  146 ballots were separated as "damaged" instead of "spoiled" in the November 2008 election. When are ballots considered damaged and not spoiled? Why were another nearly 9,000 ballots removed that were not accounted for as "damaged" in the Tally Center Log Sheet?

• Issue A015: Legislative
  Law should mandate that ballots for a given precinct should be counted and included in the canvass without separating out write-ins and damaged ballots, and if they are separated, this should be clearly documented. All ballots for the precinct should be included in the PEMT.

Issue A019 - No Comparison of Ballot Count

There is no comparison of the number of ballots scanned, as reported on the report tape, with the number of ballots counted at the precinct nor by the count as read by the central tabulator. Comparing the count of ballots as counted by polling place workers with the number scanned can eliminate the problems documented by the PEMT - One Percent Manual Tally, i.e. missing ballots. Only 4 of 85 precincts in our 5% sample scanned the number of ballots (Ballots Cast) that were counted by precinct workers. Comparing the count may have eliminated this problem (although this problem is more likely due to the removal of write-ins.)

Workers do not routinely compare the count of ballots, in terms of the actual count and the count reported on scanner report with the count of ballots input to the GEMS central tabulator. Our project reviewed the count of ballots printed on scanner tapes with the audit report in our 5% sample and found no discrepancy. However, there have been recently reports of problems in Ohio using the same equipment. Ohio Voting Machines Contained Programming Error That Dropped Votes (Washington Post){{https://copswiki.org/Common/617 Ohio Voting Machines Contained Programming Error That Dropped Votes (Washington Post) - This article said: A voting system used in 34 states contains a critical programming error that can cause votes to be dropped while being electronically transferred from memory cards to a central tallying point, the manufacturer acknowledges. The problem was identified after complaints from Ohio elections officials following the March primary there, but the logic error that is the root of the problem has been part of the software for 10 years, said Chris Riggall, a spokesman for Premier Election Solutions, formerly known as Diebold. }} This article said: A voting system used in 34 states contains a critical programming error that can cause votes to be dropped while being electronically transferred from memory cards to a central tallying point, the manufacturer acknowledges. The problem was identified after complaints from Ohio elections officials following the March primary there, but the logic error that is the root of the problem has been part of the software for 10 years, said Chris Riggall, a spokesman for Premier Election Solutions, formerly known as Diebold.

• Issue A019: Question to Ro V
  In future elections, we request that the Ro V maintain an accurate ballot count (i.e do not remove write-ins and damaged ballots without noting the count of ballots removed) and compare that with the count of ballots actually scanned. This should eliminate the 29% failure rate as detected by the PEMT.

• Issue A019: Legislative
  Election law should mandate that election processing procedures include a step that compares the count of ballots as counted manually and the count of ballots scanned for that precinct by electronic scanning equipment as soon as the scan is complete. This should eliminate the 29% failure rate as detected by the PEMT.

Related issues that are described in full in other Categories of Issues of Concern

• Issue A008: Ballot Statements - Office Use Section Not Explained -- Ballot Statements have an "Office Use Only" section does not include an explanation to allow the public to understand how it is being used.

• Issue A022: VBM Ballots not precounted during scanning
  We were told that the scanner operator pre-counts the ballots as they run them, but this did not occur.

• Issue A004: No Ballot Inventory Report -- No report is generated regarding whether any errors occurred during SPUW, including the count of ballots.

Audit Log Discrepancies

COPs requested and received the central tabulator audit log. This is perhaps the most important means for oversight groups to track the election and check on the reliability of the central tabulator, elections officials, and staff. However, it is not sufficient for these purposes as there are limited data in the log. However, the log could be easily enhanced (perhaps by just making a simple setting requesting more data) without any additional cost, since the audit log is never reduced to hardcopy form.

We have the following observations regarding the audit log:

• The number of cards cast is noted in the log for precincts scanned on election night. No counts are provided for VBM ballots, Provisionals, and Touch Screen entries.
• The audit log does not provide any vote information, only the count of ballots, and then only for election night scanning.
• The Registrar does not have full documentation for the audit log, such as what all entries mean and any options or configuration settings in terms of what is provided in the audit log. (Their reply to Question C00021-21.1)
• The Registrar has no procedures for review of the log. (Their reply to Question C00021-21.2) They said the logs are reviewed by IT staff to verify that an action has taken place such as a batch has been closed and the correct number of cards cast has been captured. But there was no documentation regarding when these reviews took place, if in fact they ever did.
• There is no outside review of the audit log, except the one you are reading.
• Details of the Audit Log are available in COPs document C00019: Letter to RegistrarOfVoters regarding election processing

DRE Machine counts illegally uploaded.

There are two cases of transactions of the following form:

1225838065	Connection Opened on 172.16.1.20 (Port:1027)
1225838074	Uploaded VCenter 17000 Machine 1 DLVersion 1 Copy 0  on 172.16.1.20 (Port:1027) SN 223582 #Ballots 12 12 Precincts
1225838074	Connection Closed on 172.16.1.20 (Port:1027)

1225838148	Connection Opened on 172.16.1.20 (Port:1029)
1225838160	Uploaded VCenter 17000 Machine 0 DLVersion 1 Copy 0 on 172.16.1.20 (Port:1029) SN 208790 #Ballots 20 18 Precincts
1225838160	Connection Closed on 172.16.1.20 (Port:1029)

Ro V said (C00021-21.5) this represented voted contest counts for the ballot types at vote center 1700 (early voting location at Ro V office), from machine number 1, from the 1st copy of that touch screen card, which is being read from a touch screen connected to the GEMS server over a secured isolated network on IP address 172.16.1.20 (port: 1027) SN 223582., 12 ballots in 12 different precincts, and the next was 20 ballots in 18 precincts. (Total of 32 ballots).

We understood that the Ro V would be converting all touchscreen ballots to durable paper ballots in the election, so we are confused as to why this was occurring, and if the log is correct, this is a violation of their agreement with the So S regarding the method of conducting elections.

Audit Log Incomplete

In numerous places throughout the log, we see the transactions for starting and stopping the server. For example, at the start of the log, we see:

1223283632	Starting AV Server

However, in numerous places (ten), there is no notation that the server was stopped and it is started, or it is started and there is no “Stopping” entry. This makes us worry that the log is incomplete. In addition, during those intervals, there is significant time elapsed in the unaccounted time period. For example, (NOTEs were added):

1224517959	Connection Closed on COM3
1224517962	Waiting on COM3
1224518202	Starting AV Server  (NOTE NO “STOPPING SERVER”)

1224519519	Stopping AV Server
1224571786	Waiting on COM3     (NOTE NO “STARTING SERVER”)
1224571786	Waiting on COM2

1224586245	Waiting on COM8
1224587341	Starting AV Server  (NOTE NO “STOPPING SERVER”)

1225728881	Waiting on COM1
1225729028	Waiting on COM1
1225817009	Starting AV Server  (NOTE NO “STOPPING SERVER”)

1225837932	Waiting on COM2
1225838035	Starting AV Server  (NOTE NO “STOPPING SERVER”)

1223564989	Stopping AV Server
1224490449	Waiting on COM5     (NOTE NO “STARTING SERVER”)
1224490449	Waiting on COM3

1224519519	Stopping AV Server
1224571786	Waiting on COM3     (NOTE NO “STARTING SERVER”)
1224571786	Waiting on COM2

1225708019	Stopping AV Server
1225712288	Waiting on COM1     (NOTE NO “STARTING SERVER”)
1225712411	Connection Opened on COM1

1225817574	Waiting on COM1
1225817579	Stopping AV Server
1225819478	Waiting on COM1     (NOTE NO “STARTING SERVER”)
1225819489	Waiting on COM2

1228227206	Connection Closed on COM8
1228227210	Waiting on COM8
(END OF THE LOG)                (NOTE NO “STOPPING SERVER”)

The Ro V said (C00021-21.7):

This question assumes an order of processing that is erroneous. As stated above, the AV Server Log is a continuous log file that contains events.
Events happen before the AV server is started.
Events happen while the AV server is running.
Events happen after the AV server is stopped.

And also said to the question: Why does the log have this inconsistency? (C00021-21.7.1):

Because it is an Event driven log file. The events themselves can be driven by a myriad of other varying events.

We find these answers unsatisfactory. The audit log should be a complete accounting of events. Also, we find it interesting that the Ro V can even answer this since they have documentation regarding the meaning of the Audit Log (Their reply to Question C00021-21.1)

• We asked (C00021-21.7.2): It is possible that some transactions have been deleted from the log, when the central tabulator was still running, and then shut down later, with the “Stopping AV Server” also deleted? And they said: "We are unable to answer this. Perhaps Premier could answer it." But we were never given a contact at Premier Election Solutions (formerly Diebold Systems).

• We asked about the fact that we did not notice any “Clearing Vcenter” entries prior to the initial accumulation of votes. How do we know that the accumulators were zeroed?

Ro V said:

The initial system is cleared at the beginning of the mail ballot processing, at which time a zero ballots cast report is run. From this point forward, ballots are added to the system. It should be noted that the “clearing Vcenter” entry is for an OS memory card that is used to transfer ballots cast at the polling places (contained in ballot cartons) into GEMS on election night and during the canvass as reruns.

• We asked for the log from the earliest date it was maintained. ("If the log includes such an entry at an earlier date, please forward the complete log, including the clearing entry(ies).") However, we were never provided with the complete audit log. Therefore, we must assume it does not exist. The Ro V does not maintain an audit log for the complete election process. This is a severe and possibly negligent or criminal problem.

Audit Log Documented Software Crashes

There were a number of errors and system crashes noted in the log:

1225838402	Error Internal Error
File: DownloadAVSPort.cpp, Line 665, Date: May 13 2005 on COM8

And:

1225840829	Error Internal Error

And, and invalid Password detected:

1225850242	Connection Opened on COM2
1225850242	Error "INVALID PASSWORD" on COM2
1225850244	Connection Closed on COM2

Ro V officials were unable to explain any of these crashes and error conditions. They referred us to Premier Election Solutions but we were never given a contact (and we did ask for one).

Audit Log Documents Numerous Re-scans

There are a number of times (133 total) where the totals were cleared and a precinct re-run, starting Nov. 20 and occurring through Dec. 2, 2008, as listed below.

1227198273	Clearing VCenter 5890:0
1227198287	Clearing VCenter 14660:0
1227198295	Clearing VCenter 14810:0
1227198304	Clearing VCenter 14840:0
1227198313	Clearing VCenter 14860:0
1227198320	Clearing VCenter 14870:0
      ...
(121 lines omitted for brevity)
      ...
1228220643	Clearing VCenter 4620:0
1228220657	Clearing VCenter 10880:0
1228220671	Clearing VCenter 11660:0
1228220684	Clearing VCenter 350:0
1228227151	Clearing VCenter 7770:0
1228227169	Clearing VCenter 8230:0

Elections officials could not explain these specifically, as they do not maintain any notes of operation of the election. They said that ballots are rerun for several reasons, and that there may have been an operator error that allowed one ballot to be entered into the system twice or one that was missed because the system displayed an error that was not caught during processing. There may have been a mail ballot in the deck of polls ballots, which would also require a rerun to remove the ballots.

Recommendations regarding the Audit Log

Issue A043 - Audit Log Discrepancies

In the November 2008 Election, a number of discrepancies were detected in the Central Tabulator (GEMS) Audit Log.

• The Registrar does not have full documentation for the audit log, such as what all entries mean and any options or configuration settings in terms of what is provided in the audit log. (Their reply to Question C00021-21.1)

• The Registrar has no procedures for review of the log. (Their reply to Question C00021-21.2) They said the logs are reviewed by IT staff to verify that an action has taken place such as a batch has been closed and the correct number of cards cast has been captured. But there was no documentation regarding when these reviews took place, if in fact they ever did, and no report resulting from any review.

• In ten places, the log showed SERVER STOPPED without first seeing SERVER STARTED and vice versa. These should be paired in all cases. If they are not paired, then transactions may have been deleted (C00021-21.7.2). An explanation of this anomaly was requested from the Registrar (C00021-21.7.1) and they did not have an answer to fully explain it other than saying it could be a myriad of reasons. The Registrar suggested that we contact Premier Election Solutions, but no referral was ever provided.

• Crashes. There were a number of crashes and other error messages. The Registrar suggested that we contact Premier Election Solutions but no referral was ever provided in response to our request.

• Re-running precincts. In 133 cases, precincts were re-run but no explanation given as to why they were re-run and no report as to why the initial run was in error. (See Issue A027: No Operator Notes)

• Clearing not shown. The central tabulator should be fully cleared prior to accumulating votes, but this was not in the log. Apparently, the Ro V does not produce a log for the entire election process.

• Direct connection to DREs: Contrary to the directive of the So S, the Audit Log shows that the Ro V downloaded several dozen ballots from directly-connected DRE equipment. The So S ordered, in their Top to Bottom Review that an “air gap” be created to prevent the very unsecured DREs from being connected to the very unsecured central tabulator. If this is done, at least you eliminate DREs and the entry point for malicious software. These brief connections could have allows malicious software to enter the central tabulator and provide for later corruption of vote totals.

• Issue A043: Question to Ro V
  
  • Please obtain full documentation about the audit log, including configuration settings to allow the GEMS system to provide additional detail. (Ref: C00021-21.1)
  • Please generate procedures for review of the log and appropriate reports for any anomalies. (Ref. C00021-21.2).
  • In that review, note time that the log shows SERVER STOPPED without first seeing SERVER STARTED and vice versa, as well as any crashes and error messages, and whether initial clearing is shown.
  • Please contact Premier Election Solutions and obtain an explanation for why START and STOP are not always paired, and obtain an explanation regarding the crashes and error messages.
  • Please provide a contact at Premier Election Solutions so we can ask for additional information.
  • Please utilize written procedures for all operations, including why certain precincts are being re-run. (See Issue A027: No Operator Notes)
  • The central tabulator should be fully cleared prior to accumulating votes, and this should appear in the log.
  • Transactions for the entire election should appear in the log.
  • The directives of the So S should be adhered to regarding the requirement that DRE ballots be remade into paper ballots and that there should be no direct connection of DRE equipment to central tabulator equipment.

• Issue A043: Legislative
  The audit log can be our most important tool to provide oversight to the canvass process. However, the log must be much more complete and detailed to be of the most use to oversight groups.
  • Full documentation should be available to GEMS and the audit log. We request this so we can suggest additional settings that may also be available to increase the level of detail in the log.
  • Procedures should exist for review of the log, and it should be reviewed and a report created for each election. The review should include an explanation for any and all anomalies, such as:
    • Places where the log shows SERVER STOPPED without first seeing SERVER STARTED and vice versa. These should be paired in all cases. If they are not paired, then transactions may have been deleted.
    • Crashes. There were a number of crashes and other error messages. The Registrar suggested that we contact Premier Election Solutions but no referral was ever provided.
    • Clearing shown. The central tabulator should be fully cleared prior to accumulating votes.
    • Inappropriate use of directly-connected DRE equipment.
  • The reconciliation procedure (See Issue A026: "No Reconciliation Procedure") should include an explanation for any and all precincts that are rescanned. In 133 cases, precincts were re-run but no explanation given as to why they were re-run and no report as to why the initial run was in error. (See Issue A027: "No Operator Notes")

Issue A018 - Audit Log Insufficient

The Audit Log available from the GEMS Central Tabulator does not provide sufficient detail to reconstruct the election. The audit log should be improved to provide an exhaustive list of vote counts for every race and every precinct. This would result in a much larger file, but file size should not be cited as a factor limiting the provision of this information. COPs asked for documentation regarding the availability of additional reporting options, but the Ro V said they did not have any documentation.

The following concerns exist:

1. The entire election must be included in the audit log. The log we were given did not include initial clearing and pre-election voting intervals.
2. The initial clearing command(s) must appear in the log if we are to know that the system was correctly initialized.
3. The Ro V should have complete documentation for the audit log and for the GEMS central tabulator.
4. Every crash and error should be investigated and explained.
5. More robust entries are desired to allow an independent reconstruction of the election from the audit log.
   • Ballot counts should be provided for VBM and Provisional processing. (See Issue A020: No Log of changes to the Election Management System)
   • Complete (exhaustive) report of each download to the GEMS central tabulator should appear in the log, including the total of votes for each race.
6. The log file should have a sequential number on each of the lines to eliminate the possibility that the audit log could be altered by election workers. In the log provided to COPs, we noticed anomalies that indicate that the log may have been tampered with, specifically the intervals when the log had STOP or START entries without the other associated entry adjacent to it.
7. The Ro V was apparently in violation of the requirements that they remake all touchscreen ballots into durable paper ballots, since on several occasions, votes were transferred directly from DRE equipment.
8. Oversight groups should have access to the audit log as the election is processed, and not be required to wait for final election certification. Nothing in the audit log can change once it is produced, and therefore, it is a public document that should be disclosed immediately, and not withheld until the election is certified, even though the log will become more extensive as the election is processed.

Providing a complete audit log is the easiest, least expensive way to document the election while providing sufficient detail for oversight groups.

• Issue A018: Question to Ro V
  We asked for information about the availablity of other, more robust settings, for the GEMS central tabulator with regard to creation of the Audit Log. These questions were not answered and we were referred to Premier Election Solutions, however, our request for a contact at Premier was not ever answered. Please provide a contact at Premier to determine if additional settings in the central tabulator exist that will allow an Audit Log that includes the aspects we require for our audit.

• Issue A018: Legislative
  Election law should be modified to mandate the creation of an exhaustive audit log file. The audit log should include not only the number of ballots included in the tabulation, but also the count of votes for each precinct and for each batch of VBM and provisional balltos. In addition, a procedure must exist for the review of the log and to address every discrepancy.

Manual Tally Procedure

The Ro V maintains the One Percent Manual Tally Procedure to govern this process, which is mandated by the So S. This is also refered to as the Post-Election Manual Tally (PEMT).

Manual tally procedure in a nutshell

1. Select dates for the random draw of precincts and the actual tally, notify the public by placing a notice at the front counter. (COPs: This should also be placed on the website.)
2. Random Selection of Precincts
   1. Calculate one percent and round up.
   2. Have scheduled observers attend the draw
   3. The procedure uses three sets of balls from 0-9 and one set of balls numbered 0 and 1, representing the four digits, (ones, tens, hundreds, and thousands, respectively).
   4. Shake the containers and draw balls manually. (COPs: Since the containers are clear plastic, this may result in trying to choose specific balls.)
   5. Draw ones, tens, hundreds digits.
   6. If the three numbers in step six is 650 or less, the thousands container is then shaken, otherwise if the number is 651 or greater, the selection is complete.
   • Probability of selecting any number 650 or less or from 1000 to 1650 = (0.1)*(0.1)*(0.1)*(.65)*(0.5) = 0.0325%
   • Probability of selecting any number 651 to 999 = (0.1)*(0.1)*(0.1)*(0.35) = 0.0350%
   • The only time this would be correct is when "Cut Off" (i.e. 650 in this case) is 666 so that 666/2 = 1000-666.
     • Probability of selecting any number 666 or less or from 1000 to 1666 = (0.1)*(0.1)*(0.1)*(.666)*(0.5) = 0.0333%
     • Probability of selecting any number 667 to 999 = (0.1)*(0.1)*(0.1)*(0.333) = 0.0333%
   • Therefore, this procedure does not produce exact results and is not generally applicable, however, results are approximately correct because 650 is almost the same as 666.
   • Selecting precincts randomly will not necessarily result in even sampling of the precincts. In the November 2008 election, no precincts were selected in the range from 1 to 453 inclusive while nine precincts were chosen in the highest numbered 450 precincts. The likelihood of that happening is about 1 chance out of 10,000 tries, which is rare indeed.
3. Record contests as selected by the random draw.
4. Select additional precincts for the manual tally to cover all remaining contests on the ballot.
5. Prepare for the manual tally, including:
   • Order summary reports for election night and the related ballots. (COPs note: the staff creating these reports will know which ones are being requested, and therefore, could conceivably prepare known good reports for those precincts while the balance of the election may be substantially modified.)
6. Conduct the manual tally
   • Each precinct as one three-person team, one calls out the vote and two tally on separate sheets.
   • Supervisor compares with summary report.
   • If there is a variance, they re-tally until they agree, but no more than three times.
   • Supervisor records results, variances, and causes (if knoswn) on consolidation log.
7. When the tally is complete, return ballots for secure archival
   • Compile a memo of the results for the Ro V.

Recommendations to Improve the Post-Election Manual Tally

Issue A045 - PEMT Sample Size Insufficient

Statistics of elections should be used to determine the appropriate sample size. ElectionsMathematics.org provides an excellent analysis to determine the sample size necessary to detect corrupt precincts sufficient to change the outcome of the election. See Kathy Dopp, 'Checking election outcome accuracy Post-election audit sampling' for a thorough analysis of the statistics. COPS recommends that a 5% sample be used, because the assumption that all the precincts are the same size is not true, and this provides an additional level of confidence.

See Five Percent Sample for a full discussion of this issue and calculations related to this election.

• Issue A045: Proposal to Ro V
  

COPs recommends that the Ro V use a 5% sample in the PEMT procedure in order to detect corrupt vote counts sufficient to change the outcome of the election, and to account for the fact that not all the precincts are the same size, which is an assumption of the analysis by Kathy Dopp.

• Issue A045: Legislative
  COPs recommends changes in the law to require that at least a 5% sample be used in the PEMT. The 1% sample is too small to detect changes sufficient to change the election, with a confidence level sufficient for a reliable audit.

Issue A033 - PEMT Performed Prematurely

The PEMT is performed too early after election night and does not include a complete set of ballots for the precincts under inspection. The PEMT should be performed after all write-ins, VBM and provisional ballots have been processed. The write-ins that were removed on election night certainly should be completed before starting.

• Issue A033: Question to Ro V
  In upcoming elections, include all ballots in the PEMT manual tally.

• Issue A033: Legislative
  The Law should be refined to define exactly when the PEMT should be performed and what should be included in it. The law should define:
  • that the PEMT should include all ballots completed at polling places on election night, including all write-ins and "damaged" ballots, and it also should include all VBM ballots received by the deadline for those precincts.
  • that the PEMT should also review Ballot Statements and determine irregularities.
  • that it is not allowed to rescan offending precincts and then inappropriately deem the precincts as error free.
  • That comparison with a computer report should use the final canvass report, not an interim report. (See Issue A036)

Issue A034 - PEMT - Notification on Web Site

The Ro V should notify the public on the Ro V website regarding the selection and tally in addition to placing a notice at the front counter. The web site is much more accessible than just the front counter and will incur no significant additional cost for the Ro V but will make coordination by the public much easier.

• Issue A034: Proposal to Ro V
  Provide notification of selection and tally of PEMT precincts on the web site as well as the front counter.

• Issue A034: Legislative
  Include minor revisions to elections code to require that all electing districts provide notices on their web site as well as notices on the front counter of their office.

Issue A035 - PEMT Random Selection Not Technically Correct

The random selection of precincts procedure is incorrect and not generally applicable. COPs recommends that the Registrar Of Voters change this procedure as follows:

• Use four ten-sided die (which are easily available on-line for $3.99 for a set of 10 die).
• Roll the dice perhaps in separate boxes or use different colors to allow them to be treated as ones, tens, hundreds and thousands.
• Declare that on the die representing thousands, even numbers will be considered "0" and odd numbers represent "1".
• If the total number shown on the die is greater than the highest numbered precinct sequence number (1697 in this case), disregard the roll and roll again.
• If the precinct is from a Collection Center that has already been sampled, disregard the roll and roll again (See discussion below).

We noted that the distribution of sampled precincts was not uniform. There were no precincts selected in the first 453 precincts, but nine selected in the last 453 precincts. This can happen in a random selection process, but the likelihood that no precincts would be selected in the first 453 precincts is only one in 10,000 -- very unusual.

It would be preferrable to sample the precincts based on the structure of the collection process. Since there are 78 Collection Centers, each of the sampled precincts should come from a different collection center. To support this constraint, the last step was added to the procedure above to choose again if the collection center had already been sampled. In the November 2008 PEMT, there were two collection centers that were sampled twice.

• Issue A035: Proposal to Ro V
  Change the method of random selection as described above.

• Issue A035: Legislative
  The elections code should specify exactly how to randomly select the precincts because the statistics of random selection is frequently not well understood by elections workers. In this case, the San Diego Ro V used a methodology that was technically incorrect and not generally applicable.

Issue A036 - PEMT Computer Report Manipulation Vulnerability

There is a manipulation vulnerability regarding how the computer reports are generated. Current practice has the Ro V staff produce reports which are, because the PEMT is currently performed early in the canvass cycle, tentative at best. The reports used by the PEMT should be the (draft) final canvass report to eliminate the possibility that a compromised member of Ro V staff might substitute a known correct report for the precincts to be sampled while allowing the other precincts to be modified.

If the election was fraudulently manipulated by Ro V staff using the central tabulator, then it would be possible to cover that up by producing "good" reports for the precincts in the PEMT while allowing many other precincts to remain compromised.

See also Issue Issue A033: PEMT Peformed too early.

• Issue A036: Question to Ro V
  To avoid this vulnerability, the final canvass report should be used, and the actions of the IT staff observed by outsiders during the generation of these reports.

• Issue A036: Legislative
  Elections code should specify that PEMT procedure should use the (draft) final canvass report and not interim reports. The PEMT precincts should be unknown until after the (draft) final report is produced to eliminate the possibility that the report could be generated differently for PEMT precincts than the untested precincts.

Issue A037 - Manual Tally Done Backwards

Current practice treats the output of the computer scanners as the known good result and the tally teams redo their work until they can match it. This is contrary to the principle that the tally teams should be the most reliable result. Therefore, the PEMT procedure should be modified as follows:

1. Tally each precinct by two tally teams, each operating as they are now.
2. Compare the result of the two teams.
3. If they differ, tally again by a third team
4. If possible, determine what causes them to differ and determine the "correct" result.
5. Compare this result with the report as generated by the electronic scanners.
6. If the scanners produce a different result, rescan the ballots to determine if that is the source of the error.
7. If an error is detected, it may require that all ballots be rescanned using different equipment.

• Issue A037: Question to Ro V
  Please modify the PEMT procedure as described above.

• Issue A037: Legislative
  Improve elections code law to clearly define how the PEMT tallying should be done with the assumption that the tally teams should produce an independent result, and not rely on the computer report.

Issue A038 - PEMT Rescanning

There is no provision in the current Post Election Manual Tally procedure to allow that workers rescan precinct ballots if the vote determined by the manual tally differs from the electronic scan. However, the Ro V rescans the ballots. They confirm the error (i.e. additional ballots are discovered in the re-scan) but the Ro V nevertheless declares that the precinct is error free. The rescanning procedure to confirm an error must be included in the written procedure if it is to be performed, and then the consequences of finding the error must also be described, such as performing a complete election rescan.

• Issue A038: Proposal to Ro V
  Your method of handling discrepancies in the PEMT is not documented, and your current practice is absolutely incorrect. If there are offending precincts, a full explanation should be included, and if the precinct can be corrected by rescanning, that would imply that the entire canvass may be faulty, and may need to be completely rescanned after corrections are made to scanner operating procedure.

• Issue A038: Legislative
  Elections code law should be enhanced to clearly specify that the Ro V is not allowed to simply rescan the offending precincts in the PEMT and fix any problems and then declare everything is resolved. The conclusion is quite the opposite. If there are offending precincts, a full explanation should be included, and if the precinct can be corrected by rescanning, that would imply that the entire canvass may be faulty, and may need to be completely rescanned after corrections are made to scanner operating procedure.

Issue A039 - Tally Sheets too big to process automatically

The Post-Election Manual Tally (PEMT) should use paper that is easily processed by automatic document feeding equipment. Currently, the tally sheets are on over-sized paper and are difficult to scan.

See Issue Issue A023: Documents Automatically Processable.

• Issue A039: Question to Ro V
  Please use Tally Sheets that conform to standard sheet sizes so they are easy to automatically scan, and avoid staples, tabs, and other additions that will make scanning difficult.

• Issue A039: Legislative
  See Issue A023: Documents Automatically Processable.

Issue A040 - PEMT Reports Incomplete

The PEMT should produce a report for every race and every precinct, as suggested by the So S. These sheets are easy to prepare if they are prepared when the manual tally is conducted. The resulting number of pages should be at least (Number of Precincts)*(Number of Races). For the November 2008 election, this would have produced about 400 pages for VBM and 400 pages for election day results. (The number of races applicable to any Precinct is less than the total number of races run in the county as many are not county-wide.) The report prepared by the Ro V had only five pages, not 800, and did not include any vote counts. (By comparison, Los Angeles County produced 1,300 pages in their report.)

• Issue A040: Question to Ro V
  The So S suggests a format for the PEMT report but the Ro V ignores those requirements. We have requested compliance in past elections and have yet to see the Ro V comply with the recommended format. We require compliance to help us with our oversight task.

• Issue A040: Legislative
  The So S suggests a format for the PEMT report but the Ro V ignores those requirements. This should be specified in law with penalties to provide a means to force compliance.

Issue A041 - PEMT Should Reconcile to Rosters

The PEMT does not look at the ballot statements and sign-in rosters, and are restricted to the ballots actually run through the scanners on election night. Unfortunately, since there are many (9,000) write-ins removed, the PEMT does not match the number of people who signed the rosters at the polling place. The PEMT should include a complete look at the precincts under consideration and not limit the view to just the operation of the scanners. See also Issue A033: PEMT Peformed too early.

• Issue A041: Question to Ro V
  Please modify the procedure used in the PEMT to include review of sign-in rosters and BallotStatements, and include ALL ballots to match sign-in rosters and ballot statements.

• Issue A041: Legislative
  Law should specify that PEMT should reconcile ballot counts to original sign-in rosters, not just to the computer reports. See Issue A033: PEMT Peformed too early.

Issue A042 - PEMT Errors Not Addressed

In the November 2008 Election, a number of errors were detected by the Post Election Manual Tally (PEMT) procedure. These issues were not addressed and the Ro V simply ignored them. The Ro V said the errors were resolved with the reconciliation procedure (which is not documented and does not have any report) but there is no confidence that this procedure actually resolves these issues.

• Of the original 17 precincts sampled, 5 had errors, (29% error rate).
• The additional 33 precincts combined (50 total) had 10 failing precincts, (20% error rate).
• 5 ballots were lost in the 1% sample. By extension, 1134 ballots were lost (about 8 per each scanner on the floor).
• Apparently, no research into whether the vote was different (Vote Substitution error) unless ballots were missing or total vote count different.
• This issue is in addition to the 9,000 "missing" ballots due to removal of "damaged" and write-in ballots.

• Issue A042: Question to Ro V
  You have refused in the past to answer our question as to why 29% of the precincts in the 17-precinct sample had errors of some kind, with 5 ballots lost. This loss exceeds the two-ballot loss allowed for all precincts.

• Issue A042: Legislative
  The Ro V simply ignores errors revealed by the PEMT by rescanning those precincts, these failures (29% of the precincts tested) actually proves that there are serious problems with the processing performed by the Registrar of Voters in San Diego County. Election law must be improved to clarify the responsibilities of the Ro V with respect to errors resolved by the PEMT procedure.

Audit Trail

Transparent and verifiable elections are essential to the operation of any democracy. To instill these qualities our elections procedures, it should be possible for an outside organization to audit the results, with minimal cost, difficulty, and delay. Such transparency is far from the reality of our elections process today, rendering a complete review of the even the count of the ballots processed nearly impossible.

The following suggestions would improve the ability of an organization like COPs to provide desperately needed outside oversight of the operation of elections in San Diego County:

Issue A002 - Public Posting of Audit Trail

The paper audit trail should be posted on the Internet on election night by elections officials so anyone can review it. Currently, oversight groups must access physical documents themselves or pay to have them scanned. Documents such as: Ballot Statements, Audit Log, Chain of Custody Report (disposition of all seals), and the Reconciliation Report are essential and should exist and be provided on the Ro V website to allow the public to easily access it.

• Issue A002: Proposal to Ro V
  Post all elements of the audit trail, such as Ballot Statements, Audit Log, Chain of Custody Report (disposition of all seals), and the Reconciliation Report, as soon as the information is available (not after the certification of the election), in electronic form, and preferably on your public web site. Scan and make available image files for all ballots for review by the public, as suggested by the Open Canvass proposal.

• Issue A002: Legislative
  Transparent and verifiable elections are integral to our democracy. Documentation of all elements of the audit trail, such as Ballot Statements, Audit Log, Chain of Custody Report (disposition of all seals), and the Reconciliation Report should be available on the Ro V website for review by oversight groups. The Audit Log should be improved, as is mentioned in the section Audit Log Discrepancies, and posted in its entirety.

Issue A023 - Documents Automatically Processable

Documents that are considered public, such as Ballot Statements, Street Indexes, and others should be automatically processable to minimize oversight costs. These documents should not have additional tabs, "sticky notes", or writing on the back added to them by poll workers and they should be of a size appropriate for automatic scanning equipment. For example, tabs effectively limit the ability for automatic document feeding equipment to operate on the documents and thus increase the cost for an outside organization to gather this information.

• Issue A023: Question to Ro V
  Public documents, such as Ballot Statements, Street Indexes, and others, should not have additional tabs, "sticky notes", or writing on the back added to them by poll workers and they should be of a size appropriate for automatic scanning equipment. Instead, workers can use separation sheets with tabs to expedite flipping to the correct page. Notes pages should be provided and precinct workers trained to add any notes on the front of those pages, and not using tabs or sticky notes.

• Issue A023: Legislative
  To make oversight of elections processes economically feasible, all public documents should be of appropriate sizes for automatic scanning, and there should be no tabs or other additions to those documents that will make manual scanning necessary.

Issue A009 - Ballot Statements Not Scannable

The Ro V claims that it is illegal to scan the Ballot Statements in their entirety because the signatures of volunteers and staff members who complete the Ballot Statements would be publicized. Citizens reject this claim and want these documents scanned in their entirety and placed on a public website. These are public documents and it is a violation of the CPRA not to produce them in their entirety for public review.

• Issue A009: Proposal to Ro V
  Change procedure when this issue is settled and described by the Elections Code.

• Issue A009: Legislative
  This issue needs to be settled by statute since the Ro V now claims that signatures of elections workers that authenticate the document are private and cannot be disclosed. Citizens want this issue settled by improving the Elections Code to explicitly state that the Ballot Statements (and all similar documents) will be scanned and accessible to the public.

Issue A024 - Scanner Tapes Not Accessible

Scanner report tapes are no longer available early in the canvass. According to state election code, a second copy of the scanner report was required to be printed when these scanners were used in each precinct, with that report being displayed outside the precinct door for anyone to inspect. However, the printing of the second report is no longer a practice when they are used in the Tally Center. This means we have to wait until the election is certified before we can start to review the election, which is an artificial restriction. The Ro V did make the original reports available for inspection, and we scanned the reports from 5% of the precincts in our review.

• Issue A024: Question to Ro V
  Please make the tapes accessible early in the election, as a last resort for our oversight review. See Audit Trail for a complete review of this issue.

• Issue A024: Legislative
  To aid oversight groups to track election processing, the following should be corrected:
  • Scanner Reports Available as soon as they are produced.
  • Scanner Reports Easily processable (i.e. not register tape).
  • Scanner Reports provided in electronic form.
  • OR: Improved Audit Log (detailing the exact vote of each precinct, the same as the scanner reports) in electronic format which is available immediately as the canvass is processed. See Audit Trail for a complete review of this issue.

Issue A025 - Scanner Tapes Difficult to Process

The audit trail provided by the current Ro V procedures include cash-register style paper tape which is difficult to process and sometimes impossible to read. Transparency of our Ro V procedures demands an audit trail that is much easier to process. Scanner reports should be produced on paper that is easily processable (such as cut-sheet letter paper) and with higher resolution printers that do not suffer from feed errors or light printing. These reports then can be easily scanned by oversight teams. (This suggestion is not essential if the audit log is improved or audit devices installed.) See Audit Trail and also Issue A023: Documents Automatically Processable, Issue A024: Scanner Tapes Not Accessible, Issue A018: Audit Log Insufficient, and Issue A029: Audit Devices Should be Allowed.

• Issue A025: Question to Ro V
  See Audit Trail

• Issue A025: Legislative
  Scanner reports must be improved to aid in oversight. See Audit Trail

Issue A017 - Scanner cards not Archived

Memory cards used to capture the vote from each scanner are not maintained as a permanent record of the election. It is too difficult to access data to reconstruct the election. At present, the only option for oversight groups is to scan the report tapes produced by the ballot scanners, and these do not include any VBM or provisional ballots. If the memory cards were archived, then oversight groups would be able to reconstruct the election results based on those cards without needing to resort to scanning the scanner reports. Such oversight is a check of election manipulation within the GEMS central tabulator. Note: It is preferable and less expensive for elections officials for oversight groups have access to a complete audit log. (i.e. including all information downloaded from the scanners, not just the count of ballots) and including the VBM and Provisional ballots scanned. (See Issue A018: Audit Log Insufficient and Issue A029: Audit Devices Should be Allowed)

• Issue A017: Question to Ro V
  If a complete audit log is not available (Issue A018), and if no audit devices are allowed to collect all information transferred to the central tabulator (Issue A029: Audit Devices Should be Allowed), the Ro V should archive the scanner memory cards so these can be accessed by oversight groups to easily reconstruct the results of the election for a sample without needing to scan the report tapes from the scanners, and use memory cards for all scanning operations.

• Issue A017: Legislative
  If the complete audit log is not available (Issue A018), and if no audit devices are allowed to collect all information transferred to the central tabulator, elections officials should be required to archive the scanner memory cards as a record of the election so these can be accessed by oversight groups to easily reconstruct the results of the election for a sample without needing to scan the report tapes from the scanners.

Issue A029 - Audit Devices Should be Allowed

If no improvement to the audit log is possible, then audit devices should be placed on the serial interface cables that supply data to the central tabulator to allow a log of all communication from all scanner and DRE equipment to the central tabulator. Data from those audit devices would allow an oversight activity to reconstruct the election and guard against tabulator-based election manipulation by unauthorized elections workers, and can eliminate the need to scan scanner report tapes and other difficult to process documents.

• Issue A029: Proposal to Ro V
  The use of audit devices on the serial interface cables is the easiest way that you can provide for complete oversight while not changing current operations. It is preferable to improve the Audit Log, because that does not require any audit devices. Short of that, placing audit devices on serial interface cables will allow oversight groups to capture all communication on the line in both directions and save it into a memory device.

• Issue A029: Legislative
  If an exhausting audit log is not possible to create, then it should be possible to install audit devices on the serial interface cables on all scanner and other vote counting equipment to allow exhaustive inspection of the vote-count data being sent to the central tabulator. Such audit devices can significantly improve the reliability of the canvass and guard against manipulation of the vote count by compromised elections workers working using the central tabulation equipment or due to programming or innocent ballot handling errors.

Issue A027 - No Operator Notes

A log of all operator activities should be maintained that explains the rationale for re-scans, etc. At present, no operator log is maintained while 133 re-runs occurred with no explanation.

• Issue A027: Question to Ro V
  See Issue A026: No Reconciliation Procedure

• Issue A027: Legislative
  See Issue A026: No Reconciliation Procedure

Related Issues
The following issues are related to this category but are fully described in another Issues of Concern category:

• Issue A018: Audit Log Insufficient
  The audit record available from the GEMS Central Tabulator does not provide sufficient detail to reconstruct the election.

• Issue A020: No Log of changes to the Election Management System
  The Election Management Systems is updated when a VBM ballot is received. However, there is no audit log of each transaction.

• Issue A028: No Reconciliation Report
  A reconciliation report should be provided that includes an explanation for any irregularities and provides a means to document that the canvass is complete.

• Issue A030: No Paper Trail for VBM and Provisionals
  Unlike ballots processed on election night, no scanner reports are produced and ballots are read directly into the central tabulator.

• Issue A039: Tally Sheets too big to process automatically
  The Post-Election Manual Tally (PEMT) should use paper that is easily processed by automatic document feeding equipment.

• Issue A040: PEMT Reports Incomplete
  The PEMT should produce a report for every race and every precinct, as suggested by the So S.

• Issue C001: Logic & Accuracy Testing Not Witnessed by COPs
  Logic & Accuracy Testing Procedures not witnessed nor video recorded by our project team.

• Issue C001: Question to Ro V
  Please provide advance notice to our project team so we may witness and video record Logic & Accuracy Testing.

We would also like the actual ballots completely imaged and provided to the public in a timely fashion. For more information on this proposal see Open Canvass, a method to completely image the ballots in the election and allow public review in a timely fashion.

Audit Trail Options

There are a number of options that must be emphasized with regard the audit trail. The following options are mutually exclusive, i.e. we need only one, and they are listed in the order of preference. The goal of these options is to allow the entire election to be reconstructed by oversight groups.

1. Complete Audit Log (See Issue A018 - Audit Log Insufficient) -- This will allow oversight groups to completely reconstruct the election inexpensively and relatively easily. This is the best option that may be available if the Ro V had documentation on the GEMS audit log and the options available. If not already available as an option in the GEMS central tabulator equipment, the software should be improved to provide this function.
2. Audit devices allowed (See Issue A029 - Audit Devices Should be Allowed) -- Will allow complete reconstruction of the election but will impose the cost of the audit devices and require that they are installed on all serial cables.
3. Scanner memory cards available and used for all scanning. These memory cards can be used to reconstruct the election only if they are used for all scanning and they must be available for audit:
   • VBM and Provisionals must produce scanner tapes (and therefore scanner memory cards) (See Issue A030 - No Paper Trail for VBM and Provisionals)
   • The scanner memory cards must be archived and available for audit. (See Issue A017 - Scanner cards not Archived)
4. Scanner Tapes must be complete and processable, the following must be addressed:
   • Scanner Tapes must be accessible early in the canvass Process (See Issue A024 - Scanner Tapes Not Accessible)
   • VBM and Provisionals must produce scanner tapes (See Issue A030 - No Paper Trail for VBM and Provisionals)
   • Scanner tapes must be easier to process (See Issue A025 - Scanner Tapes Difficult to Process)

Concluding Remarks

Some concluding remarks are in order. Opinions are those of the primary investigator, Raymond Lutz.

RoV not prepared for oversight

It is a common observation by COPs regarding not only the Registrar of Voters, but virtually all other bodies we have attempted to oversee. They are absolutely not prepared for structured oversight by citizens and indeed a bit shocked when such thorough oversight is attempted. It would be very helpful if elections and other county officials embraced the desperately needed oversight function provided by groups like COPs. They don't. Instead of being provided with a complete documentation package which could be easily provided to anyone and everyone on their web site, they resist the oversight function, making almost no documentation available and making it necessary to reverse-engineer their processes, spending countless hours just trying to find out what they intend to do before we can find out if 1) they are doing it, and 2) it is the right thing to do. Of course, if nothing is documented, there is little chance that they will be cited for not following their own procedures or that they will be pestered by any suggestions for corrections or enhancements.

Likely to be Productive

The method of oversight COPs used in the production of this document is a departure from other oversight methodologies, such as exit polling and post-election random audits. Those approaches tend to disregard the actual detailed operation of the Ro V, and instead they compare the official canvass result against exit poll results or inspect ballots in a set of precincts. In contrast, the method used here is to carefully review the intended procedures in use by the Ro V, make sure they adhere to those procedures and push for changes in the procedures when they are insufficient or wrong. In addition, we check the progress of the election in minute detail as it is processed by the Ro V. Perhaps the most important result of this effort is to understand that we can potentially track every move of the central tabulator with a more robust audit log, hopefully one that will be sufficient to allow us to reproduce the results and thereby prohibit central tabulator manipulation or even honest mistakes. If that is not possible, we propose the use of simple audit devices that capture every bit on the communication cables to the central tabulator, and make that information available to audit teams.

We look forward to a continued productive relationship with the San Diego County Registrar of Voters, the California Secretary of State, and the California State Legislature and Executive branch to bring these issues to a productive conclusion.

Precinct hand-counting is not practical

It is the opinion of the primary investigator, based on the poor performance of precincts in reconciling the count of ballots, that it is not feasible to expect these precincts to hand-count the entire election on election night, and the public will provide oversight for each precinct. In our sample, 83% of precincts were not able to reconcile the count of ballots, let alone trying to tally the entire election. The number of ballot options that any precinct would need to tally were commonly more than 60. COPs video recorded the hand-tally operation of the single precinct in Potrero in the December 11, 2007 VBM recall election of the Potrero Planning Group members who had voted to approve the Blackwater training camp. With only 10 races (5 recall questions and 5 replacements) and about 375 voters, the counting process still took nearly four hours using a fresh tally team, and then it was repeated to check on those results, for a total of about eight hours. The video of this counting process is available on the COPs website.) Although the tally process could be expedited through use of other methods (such as the "sort and stack" method), expecting tired poll workers to perform this duty is beyond reason. Fresh teams of poll workers may be able to perform this duty, but the fact remains that any recounting or oversight function becomes nearly impossible. Oversight of 1697 precincts and finding fresh teams of people that are highly training to perform the tally function for every precinct will be difficult if not impossible.

And, the hand-counting method does not deal with VBM ballots that now comprise a large fraction of the ballots received (about 60%).

Instead, COPs does not consider the use of electronic equipment a lost cause, as long as there is sufficient visibility to the entire process. Key to the ability of oversight groups to perform their duties is to be able to view the central tabulator audit log. COPs encourages election integrity groups that promote hand-counting of paper ballots as the only best solution to reconsider, and would like to point out the Open Canvass method which proposes that all ballots be scanned and provided to competing recognition and tabulation groups. Even with the Open Canvass method, it is necessary to maintain strict chain-of-custody and other accounting that is raised as a concern in this report.

Application to other elective districts

COPs encourages oversight groups to use the approach of this report as a template to provide oversight to elective districts across the nation. It is a big job and will require hundreds or thousands of committed citizens to provide the oversight necessary to tame our dysfunctional elective process. But it must be done, and now is the time to start.

Did our investigation detect any fraud, or were these just honest mistakes?

[This section was added after the initial release of the report based on questions from reviewers]

As clearly described in the body of this document, there are many issues that can be cleaned up by the Ro V to improve confidence in our elections. But, even with those deficiencies, is there any evidence of malfeasance or "rigging" of the elections by officials or by outsiders? The PEMT (1% Manual Tally) detected failures in 29% of the initial sample of 17 precincts, and 5 missing ballots were detected, but are those failures sufficient to prove that the election results are in doubt?

Perhaps the best way to provide an analysis of this question is to present possible attack vectors based on vulnerabilities that exist based on our analysis. It is important to note that we are not making any accusations of malfeasance. In such an analysis, we must assume that no person can be trusted, and we must rely on procedures and documentation to guard against attacks. These scenarios are sometimes difficult for those involved to entertain, much like a couple discussing a prenuptial agreement. To discover a means to guard against the attacks, however, requires that we consider the possibility that insiders are involved to the extent necessary to allow the attacks to complete. We do this only to determine a means to guard against the attacks.

Chain of Custody Attacks

Ro V documentation described 99 cases of incorrect, broken, or missing seals, and there is no attempt to log and track seal serial numbers. There is no SPUW (supply pick-up weekend) procedure or overall report that might further document the overall number of blank ballots available. There is very loose control of VBM ballots once they are removed from their envelopes. How much might the election be modified with these in mind? The two examples below can be eliminated with improved accounting of ballots and improve seal tracking.

Ballot Substitution Attack

This attack requires additional blank ballots that could have been printed by the ballot printing vendor. Ballots in boxes in transit to the Tally Center are substituted with the additional ballots, voted according to the desires of the attacker. Since the seal serial numbers are not tracked, the attackers could have tampered with any cartons and resealed those cartons. The 99 cartons with suspect seals may only be decoys.

It would be most likely applied to a single or a few vans on their way between Collection Centers and the Tally Center, so it would affect an average of 22 precincts for each van that is compromised. Each precinct has an average of about 400 ballots, so the total risk is about 8700 ballots per van. It could affect VBM ballots as well if an insider substituted the ballots before they were scanned. The substituted ballots could not choose races with the desired outcome for more than perhaps 40% of what would be expected or it would be obvious to an outsider, so that could mean that the desired race would get a bump of 0.40 x 8700 ballots, or 3480 ballots, and if the race choice was changed, that would amount to a net margin change of twice that amount, or nearly 7,000 votes. In local races, this would clearly be sufficient to change the outcome of the race, and there is no way to detect the attack once it has been successfully completed.

Ballot Remarking Attack

Similar to the above attack, but in this attack, the attackers modify the existing ballots by adding marking to them, typically to over vote on ballots that are already voted opposite to their desired race outcome, and if the race is left blank, they vote for their desired outcome. This attack can be detected by a large number of overvotes in a race. This attack does not require any blank ballots to be printed, but it requires a significant amount of time to complete.

Scanning Attacks

Proprietary scanners provided by Diebold Systems (now Premier Election Solutions) contains secret firmware that may have hooks for improvements or enhancements. Scanner memory cards for specific precincts may have embedded computer code that can modify the reported results for those precincts, perhaps flipping the winners of those races.

When applied to the ballots processed on election night, this attack can be detected by a sufficiently large sample of precincts and manually tally them, with close races requiring a larger percentage sample. In the last election, our calculations showed a 5% sample would be sufficient but a 1% sample may not detect this attack.

Central Tabulator Attacks

The central tabulator simply adds up the votes for each race. Although certified by the So S, there still exists a risk that the central tabulator software will become compromised, particularly if connected directly to DRE devices. Although banned from such direct connection, DRE's were connected directly to the central tabulator in the November 2008 election, according to the audit log. If applied to VBM ballots, there is no way to check on these attacks short of a complete manual tally of the VBM ballots for that precinct. The current PEMT is done so early in the process, and it includes a report-substitution vulnerability, so it is of little use to guard against this attack.

Improved tracking of VBM ballots, a comprehensive (post election) PEMT and an improved (exhaustive reporting) audit log or audit devices on communication cables connected to the central tabulator can eliminate these attacks.

Summary

In summary, the current level of transparency does not provide sufficient observational detail to allow us to prove that malfeasance exists nor to prove that it does not exist. Improving the audit trail will allow us to provide an independent analysis that there are no known attack vectors and that the results can be trusted.

Appendix

All Precincts

We collected data in 85 precincts by scanning the report tapes that are produced by the Diebold (Premier Election Solutions) scanners, and then manually typed the data into our web-based database.

You can take a look at a summary of the precinct data here: http://www.copswiki.org/Cops/AllPrecincts Simply click on a precinct sequence number and you can view the precinct data as entered by our volunteers. Click on attached documents to view the scanned data for each precinct.

All Races

The data for each race is pulled from the precincts in our sample. See that data here: http://www.copswiki.org/Cops/AllRaces. You can click on a specific race to see the contribution from the sampled precincts that included that race. Note that because our data did not include the missing 9,000 ballots or any VBM or provisional ballots, our totals do not match the canvass report totals.

In addition, we had a difficult time collecting the data in this fashion. See the Race for Proposition 8 (http://www.copswiki.org/Cops/Race670). We really tried to get all the data in on this one correct since it was so controversial. We had to leave out several precincts because the data was corrupted. In the first case, we simply could not read the scanner tape, for example.

Why we gathered this data

Our intention in gathering all this data was to see if we could detect tampering with the VBM and provisional ballots, since we had no way to review those. If we saw any race that was remarkably different from the certified results (like Prop 8 "No" winning) then an argument could be made that the VBM and provisionals, which have no audit trail that we can inspect, must have been fiddled with to get the result to flip the other way.

We weren't able to attempt to prove that hypothesis, but there was so many other issues we found, that the work was still of great benefit to bring to the attention of the public. It is our hope that in future elections, we will be able to get an exhaustive Audit Log of the central tabulator because those entries should exactly match the data scanned, and we can reconstruct the results of the election from that log. Such a 100% reconstruction would eliminate any meddling in the outcome of these elections by compromised elections officials who have access to the central tabulator.

%STOPPUBLISH%