Cops Canvass Report Chain Of Custody

This is a section of the Cops Canvass Report. See also San Diego County Canvass Procedure

Chain of Custody

Chain of Custody Overview

The term "chain of custody" is most commonly used with regard to legal evidence. Chain of custody refers to the chronological documentation, and/or paper trail, showing the seizure, custody, control, transfer, analysis, and disposition of evidence, physical or electronic. In elections, it refers to the active control asserted by the Ro V over blank and voted paper ballots, sealed ballot boxes or ballot cartons, electronic media, and other documents related to the execution of the canvass.

Robust ballot accounting and secure chain of custody of election materials and equipment are prerequisites for accurate election results and post-election audits. The following conditions must be met:

1. There are strict written accounting procedures for paper records to prevent the addition, subtraction, substitution, or alteration of paper records.
   • Durable Paper Ballots are used as the primary Cast Vote Record (CVR).
   • Blank ballots must be strictly controlled to avoid ballot substitutions.
2. To safeguard the ballots and audit records from loss and tampering, paper records and electronic equipment are fully secured at all times when a breach could adversely affect the integrity of the records including from the time the votes are cast until all audit or recount activity is completed and election results are finalized, including the expiration of all legal recourse to challenge or correct the election.
   • Procedures regulating access to ballots and equipment could include requiring signatures for access and documenting the reason for it, preventing access by a single person, requiring that access be observed by members of opposing parties, or the use of surveillance cameras to guard storage areas.
3. An audit of these procedures should begin as soon as possible after the random selection of audit units, which commences as soon as possible after the initial tallies recorded by the voting system are reported, the audit conducted by an independent group of analysts.
4. The secrecy of the ballot is preserved.
   • It must not be possible to determine how a person voted by inspecting election records (although those records do document whether the voter voted in the election.)
   • The order of the votes cast is never compared to the order in which the voters signed in.
   • Each ballot, although it may be identified with a unique identifier, must not be connected to the identity of the voter.
5. There is a reconciliation to ensure that all votes from all audit units are correctly tabulated in the election totals.

Because of the reliance upon the durable paper ballot coupled with the fact that these ballots are not fully imaged and archived on digital media (as is proposed by the Open Canvass Method), chain of custody is a concern during nearly every procedure. However, we use the term here to mean the chain of custody prior to the Tally Center, and with regard to VBM ballot handling.

Chain of Custody - Pre-Tally Center

The first subcategory of issues in the Chain of Custody has to do with the control of ballots, blank and voted, distributed to the precincts and before they reach the Tally Center. The Ro V uses tamper evident seals in an attempt to impose strict control on blank and voted ballots.

The use of tamper evident seals is now common in industry and the best practice for use of these seals is as follows:

1. Strict custody of all seals is necessary.
2. All seals have unalterable serial numbers.
3. A trusted person must have custody of some subset of the seals distributed for use. The serial numbers distributed to that person must be documented.
4. The trusted inspector must inspect the item to be sealed, and preferably, witnessed by a second person. The serial number of the seal is then documented by the trusted inspector in separate documents.
5. If the item must be opened and resealed, this must be documented as well, including the serial numbers of the old and new seals.
6. All remaining seals must be returned.
7. At each stage of inspection of the item, the seal number should be checked to validate that the seal has not been changed, and any evident tampering must be documented immediately.
8. The documentation must be maintained securely to allow checking the serial numbers of the seals. There is an implicit assumption that the chain of custody of the documentation is more secure than the chain of custody of the seals items.

Unfortunately, the Ro V does not follow the elements of these best practices, making the use of these seals nothing more than a sham.

The chain of custody of important documents by the San Diego Registrar of Voters is extremely lax and in need of improvement. This issue is severe and may be negligent or criminal. There is no sense in using tamper evident seals on ballot cartons if there is no investigation of tampering when there is such evidence in 99 cases. Similarly, we are told that the entire facility is under observation by closed-circuit video camera. However, the Ro V did not provide any documented procedures regarding review of the video camera evidence. Therefore, these procedures are nothing more than shams. "The whole place is under video surveillance" means nothing if no one watches the video. "We use tamper-evident seals" means nothing if evidence of tampering is clear and yet goes without consequence and there is no investigation or explanation.

The Ro V must be required to produce a comprehensive chain-of-custody report including rationale for every broken and irregular tamper-evident seal. At this point, there is some logging of seals but no serial numbers, and then no report on the whole situation.

Issues of Concern related to Pre-Tally Center Chain of Custody

Issue A004 - No Ballot Inventory Report

No report is generated regarding whether any errors occurred during SPUW, including the count of ballots.

• Issue A004: Proposal to Ro V
  Create and provide, in the normal course of business, a Ballot Inventory Report, regarding whether any errors occurred during SPUW.

• Issue A004: Legislative
  Make creation of a "Ballot Inventory Report" mandatory, regarding whether any errors occurred during Supply Pickup Weekend, including the count of blank ballots and why any errors occurred, and how these errors can be rectified in the future.

Issue A005 - No Seal Serial Number on Ballot Statements

Serial numbers of the tamper-evident seals are not included on Ballot Statements. Using tamper evident seals with serial numbers and documenting those serial numbers in companion documentation is a requirement for a legitimate seal management strategy.

• Issue A005: Proposal to Ro V
  Include seal serial numbers on ballot statements and add a procedure to note the serial numbers of all seals used on ballot cartons and elsewhere.

• Issue A005: Legislative
  Recording of serial number of any tamper evident seals must be made mandatory. For San Diego, seal serial numbers should be recorded on ballot statements. Also, included in the comprehensive procedure documentation must be a procedure to note the serial numbers of all seals used on ballot cartons and anywhere else, and a procedure to investigate seals that show tampering.

Issue A012 - Collection Center Seal Logs Lack Serial Numbers

Authorized personnel at Collection Centers are required to inspect the tamper-evident seals, but there is no place on the log sheet to document the seal numbers nor to note whether the seals were intact. Collection Center Logs documented only 6 tampered seals while 99 tampered seals were later detected at the Tally Center. Documenting serial numbers of seals is a requirement for a legitimate seal management strategy.

• Issue A012: Proposal to Ro V
  Improve the chain of custody of the ballots. Collection Center personnel must be required to inspect all ballot boxes received from the precincts. Security seals must be confirmed to be properly affixed and without evidence of tampering before precinct workers are relieved of their duties. Each inspection must be reported in writing to indicate the precinct and seal number for each box, the names of persons delivering the ballots, that the inspection was performed, that the box and seal is intact and without evidence of tampering. No precinct worker may be relieved of his or her duties until the collection center personnel are satisfied that the box is properly sealed and the report in writing is completed. Automated bar-code scanners can expedite the collection of seal serial numbers.

• Issue A012: Legislative
  Mandate that chain of custody reports at collection centers include status and serial numbers of all security seals (and the process described above).

Issue A016 - Tally Center - 99 Seals broken or wrong

In the November 2008 election, Tally Center Logs document 99 precincts that had wrong or broken seals, a 6% rate, and there was no investigation. There were no exception documents provided for our review describing why the seals were incorrect or broken. Seal documents do not include a serial number. Only a cursory inspection was performed by elections officials, and there was no attempt to validate the count of ballots as reported by the precinct. Why was it the case that 99 seals were detected as wrong or broken at the Tally Center while only six were detected by the Collection Centers? Documenting serial numbers of seals is a requirement for a legitimate seal management strategy.

• Issue A016: Question to Ro V
  Why was it the case that 99 seals were detected as wrong or broken at the Tally Center while only six were detected by the Collection Centers?

• Issue A016: Legislative
  Election law must explicitly lay out the requirements for implementing a legitimate strategy and mandate compliance. It is not enough to use security seals. Implementing a legitimate security strategy requires that the security seals each have a serial number and that these are recorded at each step of the process. In San Diego, 6% of the seals were noted as tampered or wrong, but there was no investigation or report, and there was no tracking of serial numbers. If serial numbers are not tracked, there is no way to detect if a security seal is replaced with another seal after tampering.

Issue A031 - No Seal Tampering Report

A seal report should be generated that explains all tampered seals. At present 99 seals show tampering but there is no report documenting an explanation if any from those responsible for chain of custody, what action was taken to investigate the irregularities and eliminate the tampering. It is negligent to simply report the number of seals that were broken or incorrect and take no action. The report should also explain why the tampering occurred and how it can be eliminated in the future. Evidence that 99 seals showed tampering is stunning considering particularly in light of the lack of follow-up or explanation. Also, since no serial numbers are recorded, the number of tampered seals may be much larger.

• Issue A031: Proposal to Ro V
  Please produce a seal tampering report for the November 2008 election which explains all tampering evidence.

• Issue A031: Legislative
  Elections officials should be required to prepare a seal tampering report to include at least the following:
  • Enumeration of each seal broken, incorrect, or missing.
  • Explanation regarding why each seal was tampered.
  • Changes to procedure proposed to reduce false positive detections of tampering.
  • Notices of termination of workers responsible for tampering.

Issue A011 - Spoiled Ballots Loosely Controlled

Spoiled Ballots, both VBM and election day are not under strict control. I.e. it would be a simple matter to checkmark a VBM envelope to indicate that the ballot was spoiled and eliminate it from consideration, and to covertly redo a vote and show a spoiled ballot at the polling place. To "spoil" a ballot, it should require the signature of the voter. Anyone could checkmark a VBM ballot as spoiled, and easily disenfranchise a voter. All spoiled ballots should be tracked to confirm that an unspoiled ballot is completed by the voter.

• Issue A011: Proposal to Ro V
  Modify procedure to tightly control spoiled ballots.

• Issue A011: Legislative
  Mandate that elections officials maintain records of spoiled ballots to allow confirmation that a non-spoiled ballot was eventually turned in, and to avoid the possibility of disenfranchisement by a compromised elections official who could simply checkmark "spoiled" on target ballots.

Advisory Issues related to elements of our project which can be enhanced.

• Issue C002: Ballot Order Chain of Custody
  We did not review the process of maintaining control of blank ballots and reconciliation at the precinct level. There is a concern regarding chain of custody of blank ballots. Is there a vulnerability to fraud based on accessing blank ballots and then removing and replacing completed ballots with those blank ballots which have been cast illegally?

• Issue C003: SPUW Not Witnessed by COPs
  Supply pickup weekend not witnessed nor video recorded.

• Issue C005: Collection Center Activities not Observed by COPs
  We did not witness nor record activities at any collection centers.

• Issue C006: Tally Center Incoming Reception Observation
  We witnessed Tally Center Incoming Reception but did not video record it directly.

• Issue C007: VBM & Provisional Process Witnessing
  The Vote-By-Mail and Provisional Ballot Processing procedure was not recorded on video and our description was generated solely through Q&A with Ro V staff.

---

Chain of Custody – VBM Custody

The second subcategory of Chain of Custody issues has to do with the custody and control of Vote-by-Mail (VBM) (and provisional) ballots.

Issue A010 - VBM Ballots Not Logged at Precinct

VBM Ballots were not logged, counted, or reported by the precinct. It is not necessary to sign anything to drop off your VBM ballot at the precinct or Ro V office, and this is a deficiency.

• Issue A010: Proposal to Ro V
  VBM ballots should be counted and logged when dropped off at the Ro V office or at precinct locations and placed in sealed containers. The ballot statement should include the count of VBM ballots being returned, and this count should be checked at the Tally Center when they are received.

• Issue A010: Legislative
  Improve elections code to mandate logging of VBM Ballots dropped off at precinct locations, and require that they are counted, logged, and reported, and placed in sealed containers to avoid tampering.

Issue A020 - No Log of changes to the Election Management System

The Election Management Systems is updated when a VBM ballot is received. However, there is no audit log of each transaction. A transaction log of VBM and provisional ballots must be made available for inspection. At this time, we are not aware of such a log. The Voter Data File is modified directly with no audit trail that can be inspected. If we had such an audit log, we could reconstruct the number of ballots actually received and compare that with the number of ballots scanned and entered into the central tabulator. At present, due to this lack of paper trail, such oversight is impossible.

• Issue A020: Question to Ro V
  Confirm that no audit log exists that documents each change to the Election Management System when each VBM ballot is received for the November 2008 election. Provide such a log in future elections.

• Issue A020: Legislative
  The Audit Log should include entries for each VBM ballot as it is received so that it is possible to determine if all ballots have been scanned. This is equivalent to the Ballot Statement for precinct ballots, but for VBM ballots. A robust audit log (Issue A018) should include this aspect.

Issue A021 - VBM Ballots are not counted

(Issue A021, Issue A022, and Issue A030 all treated under here because of their similarity and overlap.
VBM Ballots are not counted after being removed from the envelope and before submitting for scanning, and there is no attempt to confirm the count of ballots as they are scanned.

We recommend the following procedure:

• When VBM and Provisionals are initially processed, the Voter Data Record is updated.
• Envelopes are sorted by precinct.
• Process ballots in batches. Maintain a count of ballots processed at each step.
• Maintain a chain of custody document that travels with each batch (a "traveler") that documents the number of ballots in the batch.
• The operator of the scanner should first zero the count of ballots scanned, and then proceed to scan the batch.
• The operator proceeds to scan the batch, and produce a report tape.
• If the count scanned (scanner report) does not match the number of ballots in the batch (on the traveler), the discrepancy should be documented and the batch recounted and/or rescanned until the discrepancy is resolved.
• When the ballot counts match, the batch is approved by the operator, and the totals sent to the central tabulator for accumulation.
• The audit log should document the exact number of ballots processed in the batch and the total votes in each race processed.
• The scanner report tape, and memory card, if applicable, should be archived for inspection by oversight activities.

• Issue A021: Question to Ro V
  To maintain positive control of VBM ballots, it would be preferable to determine the total count of ballots to be scanned based on the number originally submitted, and then check the total number scanned as reported by the scanner. This should reduce the number of rescans necessary during the canvass period, should reduce errors, and should result in lower overall cost to process the VBM ballots. See the procedure above.

• Issue A021: Legislative
  Elections officials should be required to document control of the chain of custody as ballots are transported and counted, meaning that the count of ballots in batch boxes are documented in associated "traveler" documents. This allows workers and citizen oversight groups to verify that the number of ballots scanned exactly matches the count submitted, as well as allowing rapid correction of errors. See the procedure above.

Issue A022 - VBM Ballots not precounted during scanning

We were told that the scanner operator pre-counts the ballots as they run them, but this did not occur. See Issue A021: "VBM Ballots are not counted."

Issue A030 - No Paper Trail for VBM and Provisionals

Unlike ballots processed on election night, no scanner reports are produced and ballots are read directly into the central tabulator. VBM ballots and provisionals should be scanned by scanners that produce a report, so these can be accessed later. (May be avoided if the audit log is improved and available.)

This has been combined with Issue A021: VBM Ballots are not counted.

Next Section: Unscanned Ballots