Thread by @jennycohn1

Dear @amyklobuchar & @SenatorLankford: I am alarmed that your Secure Elections Act appears to allow states to force voters to use touchscreen barcode ballot markers like ES&S's ExpressVote, which has not even been subjected to human usability testing! 1/ medium.com/@jennycohn1/st…

2/ The failure 2 conduct human usability testing is what landed us in the disastrous predicament we now face w/ so-called Voter Verifiable Paper Audit Trails, which studies later showed cannot be "verified" or audited successfully. I discuss those studies in the article in post 1

3/ I worry that some of the same people who promoted VVPATs have a dicenstive to acknowledge their grievous error & are now compounding the error by equating "summary cards" from touchscreen barcode ballot markers with "paper ballots"--again without human usability testing!!

4/ Human usability testing is necessary to determine if the "summary cards"--some call them "paper ballots"--from these touchscreens can actually be "verified" and audited successfully!

5/ As explained in my article in post 1, UCB statistics professor @philipbstark--who invented Risk Limiting Audits--was himself unable to verify his selections using such a "summary card." If these things cannot be verified by actual humans, they will be meaningless in an audit.

6/ Moreover, unlike traditional paper ballots, these summary cards contain unverifiable barcodes. The barcodes are the only part of the printout actually counted as our votes! As for the text, as noted, it does not actually appear to be "verifiable" by actual humans.

7/ Indeed, as further explained in my article (with links), ES&S's touchscreens appear to instruct voters to "verify" their votes on the touchscreens without the additional admonition to try to "verify" them on the actual paper "summary cards."

8/ IT experts also have grave concerns about the use of barcodes in ballots. I include several quotes (with links) from esteemed IT experts on this issue in my sourced article.

9/ Also, a hacker need not actually "flip votes" to disenfranchise voters if touchscreens are used. A so-called "denial of service attack"--or even an unintentional "glitch" that causes the touchscreens to fail--can disenfranchise voters in a way that hand marked ballots can't.

10/ In other words, if touchscreens fail, voters may have nothing on which to cast their votes. I provide examples of where this has happened in past elections. By contrast, if hand marked paper ballots and scanners are used, voters can still vote, even if the scanners fail.

11/ We cannot 'ASSUME" counties will have sufficient backup paper ballots 4 hand marking at each polling place 2 respond to a denial-of-service attack. Election officials love touchscreens precisely bc they see them as eliminating the need to pre-print & distribute paper ballots!

12/ Adding insult to injury, the ES&S ExpressVote is used with ES&S's DS200 scanners that contain CELLULAR MODEMS, which Professor Andrew Appel (Princeton) says can facilitate man-in-the-middle hacks! Again, this is in my article with sources.

13/ Your bill does not even require manual audits until 2022! And even then, they need not be actual Risk Limiting Audits! So under your "election security" bill, voters will be using insecure election equipment without the benefit of a mandatory audit.

14/ With what we know now about the vulnerability of voting equipment, this is wholly unacceptable. Unless I am misconstruing your bill--please, please let me know if I am--your bill would do little more than allow lawmakers to PRETEND that they have secured our elections.

15/ You cannot "undo" millions of dollars worth of purchases of touchscreen barcode balloting systems. You cannot unring that bell. Nor can you unring the bill of two more elections--2020 and 2022--conducted without meaningful manual audits.

16/ Unlike your bill, Sen. Ron Wyden's #PaveAct would require states to give voters the option to mark their ballots by HAND. It would also require actual risk limiting audits by 2020. (The hand marked ballot provision can & should be accelerated to 2018).

17/ With the need for election security at such a fever pitch, I implore you to conduct a public debate about your bill vs. the #PaveAct. If there are senators hemming and hawing, or bending over backwards for vendors like ES&S, their constituents need to know!

18/ In the meantime, I beg you to throw your support behind the #PaveAct and to abandon the watered down toothless bill that your SEA has become. If there are senators who will not support the #PaveAct, they shld be compelled to explain their reasoning to the American people.

19/ Pls note that vendors are profit motivated and thus they have an incentive to sell touchscreen barcode ballot markers (which still use scanners to count the barcoded "summary cards") rather than scanners alone (4 counting hand marked ballots) bc touchscreens cost 2x as much!

20/ Thus, they have an incentive to sell the much more expensive systems based on profit, regardless of the additional significant security concerns. Nevertheless, vendor executives have landed positions advising the EAC about security standards! velvetrevolution.us/electionstrike…

21/ The EAC advisory board also includes people who have been disturbingly pro-vendor (and pro-paperless touchscreens) throughout the past 15 years and whose organizations have received vendor payments!

https://twitter.com/jennycohn1/status/1004141873743609856

@maddow

22/ Thus, it is easy to be misled by people in seemingly prestigious positions who have incentives of which you may be unaware. When it comes to election security, the "devil" really is in the details.

23/ Please pay attention to the critical distinctions between barcoded "summary cards" from touchscreens and hand marked paper ballots counted on scanners. Do not let the vendors trick you.

24/ They simply cannot be trusted. ES&S, for example, finally admitted to selling systems with remote access software after DENYING THIS to the New York Times! Dominion has apparently done the same thing.

https://twitter.com/jennycohn1/status/1019221300798152704

25/ And both ES&S and Dominion declined to attend the recent Senate Rules Committee Hearing on election security. Why you want to enable purchases of their insecure touchscreen barcode ballot markers--w/o even the benefit of human usability testing--is beyond me. Pls don't do it!

26/ Please also keep in mind that you simply cannot trust even the word of many election officials about the vulnerabilities of our election equipment. Here is a thread providing one such major example.

https://twitter.com/jennycohn1/status/963200487271968769

27/ Here is another.

https://twitter.com/jennycohn1/status/993708371940290560

28/ Sadly, the leaders of 2national election integrity organizations have also chosen to enable ES&S's ExpressVote. I believe that some of the individuals at these groups were among those who also pushed for VVPATs w/o conducting human usability testing.

https://twitter.com/jennycohn1/status/1007289610496438274

29/ I should note that certain individuals in the above organizations are quite concerned about touchscreen barcode ballot markers but are not in a leadership position.

30/ Related thread.

https://twitter.com/jennycohn1/status/1010964542052958208

31/ Here is one of my recent threads raising additional concerns with the ExpressVote touchscreen barcode ballot markers--which some misleadingly call a "paper ballot system."

https://twitter.com/jennycohn1/status/1013129975187173376

32/ And here is another post from the same Thread.

https://twitter.com/jennycohn1/status/1013132216254148609

33/ BTW, vendors will also try to fool u w/ claims that voters may not "verifiy" hand marked paper ballots either. But in the elections context, "verification" refers to the process of reviewing the paper printout to confirm that a TOUCHSCREEN HASN'T FLIPPED YOUR VOTE!

34/ This is NOT an issue with a hand marked paper ballot because hand marked ballots are software independent!

35/ Here is an example of a recent article that tried to mislead readers by suggesting that hand marked paper ballots also require "verification". I am curious to know if the author has connections to a vendor. realclearpolitics.com/articles/2018/…

36/ Vendors will also try to trick u by claiming that hand marked ballots will create long lines. As explained in my article, the opposite is true bc with touchscreens the number of people who can vote at once is limited to the # of touchscreens at the polling place.

37/ By contrast, with hand marked paper ballots, many people can fill out their selections at once with inexpensive cardboard privacy dividers. I discuss this as well--with links to sources--in my article in post 1.

38/ Finally, vendors will try to trick you by claiming that hand marked ballots have a higher error rate than touchscreen barcode ballot markers. There are ZERO studies supporting this.

https://twitter.com/philipbstark/status/997593067669544961

39/ Meanwhile, this study found an 8% error rate with ExpressVote ballots, which is quite high, especially given that ES&S itself commissioned the study! sos.state.co.us/pubs/elections…

40/ Despite the 8% error rate, the "expert" who conducted the study, and who was paid by ES&S, gave the ExpressVote a "pass."

41/ Because so many gloss over the critical distinction between #handmarked #paperballots and "summary cards" from touchscreen barcode ballot markers (that some call "paperballots), here is my new rule (subject to exceptions):

https://twitter.com/jennycohn1/status/1019664238627811328