S.C. Invested $51M in Voting Machines Against Expert Advice

(TNS) — It's difficult to talk for long about voting technology and election security in South Carolina before hearing the name of Dr. Duncan Buell.

Since the state invested in its first electronic voting computers in 2004, Buell, a professor of computer science and engineering at the University of South Carolina, has studied the performance of the technology in the region. He is one of only a couple of South Carolinians who belong to the Election Verification Network, a group of interdisciplinary voting experts from around the country, and serves on the Richland County Board of Voter Registration and Elections.

So when he discovered that a panel of five people with limited technical expertise had been entrusted to choose the new technology that S.C. voters would use for many elections to come, Buell asked to present his knowledge at one of the group's meetings in 2019, which were coordinated in part by the State Election Commission ( SEC). He was added, then mysteriously taken off the agenda, he says.

"That's not in the citizens' best interest, but he's the sharpest critic (the SEC) had," said Frank Heindel, a retired businessman from Charleston and self-described citizen activist who has requested hundreds of pages of documents from the government about S.C. elections. "I don't think they wanted to hear it."

The decision is just one example of how for years, choices about voting technology in South Carolina have been made behind closed doors, say lawmakers, citizens and voting scholars. Scientists believe the technology products S.C. officials ultimately selected, including the voting machines now being used in the 2020 presidential election, have not always met the "gold standard" for safety.

Since 2004, the methods favored by the SEC have benefited one corporation: Election Systems & Software (ES&S). Despite a decade of evidence that shows technology made by ES&S was involved with repeated voting problems in S.C. elections, the state has continued to award the majority of funds designated for election hardware and software to ES&S. The latest awards in 2019 and 2020 totaled over $57 million.

"Big decisions are being made about our voting systems, and they're being made In the dark," said Lynn Teague, vice president of the League of Women Voters of South Carolina. "They're not being made in a public hearing with testimony from a wide range of concerned citizens and experts."

When asked by The State Media Co. why Buell was not allowed to present to the panel, SEC spokesman  Chris Whitmire  said he was not aware of the specifics of Buell's request. But inviting someone to speak who had already made up his mind about which voting system he preferred, as Whitmire characterized it, would not have allowed for a fair selection process by the committee.

But some election observers say it was the state's selection process that was unfair.

Advice given, not followed

Experts and state officials agree that the voting computers the committee selected that are now being used in the 2020 presidential election, called Ballot Marking Devices, or BMDs, are safer than the ones S.C. voters were using before, called Direct Recording Electronic machines, or DREs.

In his testimony to the U.S. House of Representatives in January,  Matt Blaze , a professor of computer science at Georgetown University and researcher in the field of security and computing, described voting systems that employ DREs as "from a security perspective, by far the most problematic and risky class."

South Carolina's fleet of more than 11,000 of the computers, made and maintained by ES&S, had repeatedly been linked to voting errors. Often with the help of documents requested by Heindel, Buell reported many of the problems in his research and 2018 audit for the League of Women Voters.

The machine's software had recurring bugs, Buell noted. From looking at data of years of elections, Buell wrote that he found flaws with the code that led to votes being counted more than once, ignored or tallied incorrectly. Problems with the external hardware became more frequent as the computers got older and also led to votes not being included in official counts, he observed.

More than one problem sometimes happened at a time. On Election Day in 2012, a voting terminal in Richland County had been difficult to boot up in the morning but had eventually been made to function. When a poll manager tried to extract the votes from the device at the end of the day, however, the machine responded with an error message: "MACHINE NOT OPENED." The votes inside were not included in the original certified count, and similar error messages would run for years to come without correction, Buell observed.

In his reviews, Buell mentions that he never encountered an error in the ES&S devices so grave that it might have changed the outcome of a state race. But even small mistakes that occur in voting technology can pose a serious threat to democracy, Blaze explained before Congress.

"A hostile state actor who can compromise even a handful of county networks might not need to alter any actual votes to create widespread uncertainty about an election outcome's legitimacy," Blaze said. That bad actor could do something as simple as plant a detectable software bug in just a few voting machines or add a couple of fake names to the list of people who voted, he explained.

Then, if the "wrong" candidate wins, "they could covertly reveal evidence that county election systems had been compromised, creating public doubt about whether the election had been 'rigged,'" Blaze told lawmakers. "This could easily impair the ability of the true winner to effectively govern, at least for a period of time."

The BMDs chosen last year by the panel that are being used today are similar to DREs in some ways. Both types of voting computers display or read aloud a ballot electronically, for one. But instead of recording voter selections inside the computer's memory like DREs do, BMDs print out a paper ballot that shows a barcode and text, intended to reflect the choices the voter made on the computer. That ballot is then scanned and recorded through a different device.

Proponents of the system say that because of that print-out, voters can be trained to spot when something goes wrong before their vote is counted, and that software bugs or foreign interference can be identified quicker than with the DREs. Some disability advocates prefer the computers because they allow people with disabilities to vote with accommodations through the same machine that a non-disabled person uses, reducing distinctions between the two experiences.

But scientists say the five-member panel could have picked a safer system.

Not the "gold standard" for SC

Of the seven options submitted to the state in response to its request for proposals (RFP) last year, three vendors proposed the state buy their hand-marked paper ballot systems, also known as optical scan paper ballot technology. The hand-marked technology wasn't just significantly cheaper than the BMDs: It also came enthusiastically reviewed by top scholars.

On January 16, 2019, months before the selection committee met for the last time in May, 23 professors, researchers, and scientists from MIT, Harvard, Google and other well-respected technological institutions sent a letter to  S.C. Speaker  of the House Jay Lucas, the President of the Senate  Harvey Peeler  and the executive director of the SEC Marci Andino. Buell was among the co-signers.

The authors were clear about their consensus that simpler, hand-marked paper ballot technology would be better than the more expensive and technically complicated ballot-marking devices.

"We write to urge you to follow the advice of election security experts nationwide, including the National Academies of Sciences, the Verified Voting Foundation, and the many states that are abandoning vulnerable touchscreen electronic voting machines in favor of hand-marked paper ballots as the best method for recording votes in public elections," the letter read.

"Our strong recommendation is to reject computerized ballot marking devices (BMDs) as an option for South Carolina's voting system, except when needed to accommodate voters with disabilities that prevent them from hand-marking paper ballots," the experts continued. "Well-designed hand-marked paper ballots combined with risk-limiting post-election tabulation audits is the gold standard for ensuring that reported election results accurately reflect the will of the people."

It's a common misconception that because the BMDs spit out pieces of paper, the paper trail they leave is as reliable as the one left by hand-marked paper ballots, Buell said. What most people don't know, he said, is that when the papers imprinted by BMDs are scanned to record the votes encoded on them, the barcodes transmit the voter selections, not the printed words. Since people can't read the barcodes, "a BMD ballot is absolutely not voter verifiable."

Audits conducted after an election can catch evidence of errors in voting technology by comparing the votes printed on paper ballots to the final votes registered. For audits on BMDs to be effective, however, Buell said that auditors would need to statistically sample not just whether the text on the pieces of paper printed by the machines matched up with the votes that were eventually recorded, but whether the text matched with the information transmitted through the barcodes. Buell doesn't believe sampling like that is being done in South Carolina, so the BMDs likely won't allow for the "gold standard" in auditing here, either, he said.

Blaze echoed Buell's points about BMDs in his testimony before Congress, and added one more drawback: "If BMDs fail or must be rebooted at a polling place, there may be no alternative method for voters to create marked ballots, making BMDs a potential bottleneck or single point of failure on Election Day."

Bottlenecks can lead to long lines and wait times, which are known to discourage people from voting. The form of voter disenfranchisement disproportionately affects communities of Latino and Black voters, research from The Brennan Center, a nonpartisan law and policy institute, shows.

Blaze went on to make the same recommendation the 23 experts had sent a year earlier to S.C. lawmakers. Simple technologies, like optical scan paper ballot technology, should be deployed to make sure elections are as strong as possible against external attacks.

But in the notes scribbled by the five panelists during the meetings they attended to decide which vendor and technology system would win the S.C. award in 2019, the known security problems with BMDs and benefits of hand-marked paper ballots were hardly mentioned. The notes were obtained via an open records request and reviewed by The State newspaper.

"Handmarked systems can cause human error + doesn't provide the necessary assistance for those with disabilities," wrote Amanda Loveday, one of the five, on an evaluation form about one of the hand-marked proposals. About the BMD system proposed by ES&S, she wrote that "ES+S offers customized hardware ... a sophisticated thumbdrive vote secure system." On another form, she added that ES&S's "current relationship + knowledge of the state was a plus." The other selectors made similar remarks.

Ultimately, the group gave the hand-marked systems lower scores and voted unanimously for ES&S's BMDs, which would cost the state over $51 million.

Loveday currently works in public relations and doesn't consider herself "a tech person." Others on the committee included a councilman and two businessmen. Loveday said she did not remember being given academic articles or research from computer scientists as part of the selection process, nor did she remember being shown the letter sent to S.C. lawmakers and the SEC from the national group of voting experts about their recommendation of a hand-marked ballot system.

But Loveday didn't feel like the group would have made a better decision had there been someone with more technical expertise on the committee, she said, and her experience as a former executive director of the S.C. Democratic Party where she worked closely with the SEC qualified her to serve on the board.

The SEC followed procurement law, Whitmire added, and the panel was advised by cybersecurity experts, advocates for voters with disabilities, national consultants, county election officials and state election official administrators. After listening to them and to the representatives from each of the companies, the review panel decided that the BMDs from ES&S were best, he and Loveday agreed.

What was more, the SEC was happy with the support and commitment that ES&S had provided to the state so far, Whitmire said in an earlier conversation with The State. In his opinion, even their old machines had been reliable "like an old pair of Levi's (jeans)."

Teague of the League wasn't surprised when she heard that the committee had decided to select ES&S and its BMD system last year. "The whole thing was set up in a way that would facilitate that," she said. "We feel the procurement panel was given a biased view." Lawmakers, scientists, and citizens repeated similar concerns to The State.

It wasn't the first time questions had been raised about the SEC and its relationship with ES&S. In 2004, a review conducted by the state chief procurement officer determined that ES&S had not met the requirements of the RFP despite the fact that the state had already announced its intention to give the company the job, a Legislative Audit Council report found. The solicitation had to be rebid before it was eventually given to ES&S later that year.

And in 2018, an investigation by McClatchy, The State Media Co.'s owner, reported that the SEC's Marci Andino was among the group of election officials who were paid to attend meetings as part of ES&S's national advisory board. Andino has publicly reported accepting a total of $19,200 in expenses from ES&S since 2009, but has said that her involvement did not have any bearing on the committee's decision to pick ES&S as the vendor for the latest contracts.

Meanwhile, the Nebraska-based company was busy expanding to other states.

"The market for voting equipment is dysfunctional."

In the ES&S response to the S.C. RFP for the new voting machines, the company outlined that it provided "state-wide installations" like South Carolina's to 14 states in total, and other voting services to clients in all but eight states in America. The company's technology served over 80 million registered voters — more than any other competitor on the market — a study about the industry from the University of Pennsylvania found in 2017.

But the success of ES&S and its nearest competitors isn't owing to their technological prowess, suggested Dan Wallach, professor of computer science at Rice University in Houston. Wallach currently serves on a committee that helps develop national guidelines for voting technology products and conducts research with the nonprofit, VotingWorks. Like Buell, he is a member of the Election Verification Network.

"There's certainly nothing worthy of the phrase 'innovative' from anybody in the entire election space," Wallach said. "To the extent that we've had public analysis of the major current vendors, the code that they wrote for the previous generation of products, it was just really terrible. They were making it up as they went along."

The RFP sent to South Carolina in 2019 hints at why that might be. Of the seven ES&S employees included in the "biography" section of the company's paperwork, only one, the senior vice president of operations, seems to have obtained any sort of formal education in technology. He earned an associate's degree in applied science and electronics, then graduated with a bachelor of science in business administration. The rest of the team either graduated with a bachelor of science in marketing or business, a bachelor's of arts or an associate's of arts.

Though ES&S receives millions of public dollars to pay for voting technology and services, an ES&S spokeswoman said that the company was too busy preparing for or supporting elections to schedule a tour or call with a reporter from The State when asked in September and October. At the time of publication, ES&S did not choose to comment about the technical experience of the company's employees.

Wallach was frank about the lack of good options on the market. There are federal standards for the technology, but they're "old and inadequate." Even so, the systems available for sale today are not built to the most recent guidelines, Wallach said.

Since mainstream technology companies have largely decided not to compete for the government contracts, and most counties shy away from creating voting technology in-house, if you're a county looking to buy, all you've got are "new crappy things to replace flaky, old crappy things, and it's the same vendor," Wallach said. "The market for voting equipment is dysfunctional."

One of the ways to improve it is with greater industry transparency, he suggested.

"It's not enough to say who wins the election, the loser requires evidence," Wallach said. "The more transparent it is, the more likely that you have enough evidence to convince the loser."

This reporting was produced with support from The GroundTruth Project through a Preserving Democracy & Voting Rights Fellowship awarded to the author.

(c)2020 The State (Columbia, S.C.). Distributed by Tribune Content Agency, LLC.