As the debate continues over e-voting machines, we're seeing some more misplaced whining over attempts to make elections more fair and accurate. In San Francisco, election officials are complaining about the rules set by California's secretary of state, which will mean that this year's mayoral election ballots will need to be checked and counted by hand. Effectively, that means that results for the election won't be known for a few weeks -- rather than instantly. This leads to all sorts of whining and complaining from election officials about how unfair this is -- but since when should speedy results be more important than accurate vote counts? And, the problem is not the secretary of state at all (as the election officials imply). It's because of two separate e-voting firms who refused to take the necessary steps to make sure their machines could be properly reviewed.

First, there's Election Systems and Software (ES&S) makers of buggy e-voting machines (that they admitted in internal memos) that have been known to lose votes or count them in triplicate depending on the election. San Francisco currently uses ES&S machines to count ballots, but those machines don't work very well -- especially if the voter isn't using exactly the right type of pen or pencil. When the secretary of state demanded that ES&S allow outside security experts to examine their machines and software, the company refused to allow it, and then finally gave in, well past the deadline, and included an angry petulent letter threatening the secretary of state. This, despite the fact that the company was caught providing uncertified equipment for the last election. With all that baggage, is it any wonder that the secretary of state would ask for a more thorough method of counting the votes?

The second e-voting firm, Sequoia, was chosen by San Francisco as a replacement vendor to get rid of the questionable ES&S machines. Of course, Sequoia has its own share of problems. Last year it was revealed that there was a button on the machines that would put the machine into "manual" mode and let you vote multiple times. Sequoia claimed this button was a feature. Reasonably, San Francisco's board of supervisors requested that Sequoia hand over their software to be reviewed -- a request which Sequoia refused. Thus, the board rejected the contract... leaving everyone in the situation they're in today. So, while elections officials may complain about the rules for counting votes, it's not the secretary of state they should blame, but the e-voting companies who continue to stonewall when it comes to actually making sure their machines are secure and accurate. And, in the meantime, can someone explain to elections officials that their job is to conduct fair and accurate elections, rather than elections with quick results?

Well, the hits keep for Election Systems & Software (ES&S). The company was already facing some controversy over the fact that its e-voting machines time stamped the ballots in a way that could reveal how voters voted, and now California's Secretary of State has discovered that the company gave the state e-voting machines for the last election that were not certified. California had certified one model of ES&S machines, but the company sold a different model to five counties. The state is now looking to fine ES&S. Of course, ES&S is also the company that originally refused to hand over its source code to the state, but eventually did so along with a threatening letter about how it would hold the Secretary of State personally responsible for any trade secrets that leaked. Trade secrets like how their machines accidentally were found to count votes in triplicate? ES&S, by the way, is also the company whose machines were used in the Florida election where many votes went missing, and it was later discovered that the company had passed around memos about their buggy software that could have caused the problem. It's also the company that had an employee come here to Techdirt and post a bunch of angry comments about how e-voting machines were perfectly safe and went through more than enough testing. Apparently not in California. Update: As pointed out in the comments, the company also was just caught failing to disclose foreign manufacturing partners to federal agencies, as it's required to do. ES&S's response on being caught? Shrugged it off as an oversight that they would fix. It appears that the company doesn't seem to worry about getting punished for all its mistakes.

Another day, another security problem with e-voting machines. Obviously, one of the biggest requests from people who were nervous about the security of e-voting machines was that all e-voting machines have a verifiable paper trail. Then, at least, there's a way to recount the votes if there are any questions. Unfortunately, even when the e-voting companies finally do add a paper trail, it seems that they muck up the process. As was noted in the recent security analysis of these machines, many of the problems are because they weren't designed from the ground up with security in mind, but rather have security procedures slapped on as extras.

In this case, some Ohio activists discovered that the paper trail coming from e-voting firm Election Systems and Software (ES&S) happen to have time and date stamps on them. Those ballots are available for anyone to look at, based on election law in Ohio. Also available for anyone to peruse are the voter sign-in logs. With both of those in hand, it's not hard to put together a pretty decent list of who voted for what. You just match up the names in the order they signed in with the timestamp on the ballots.

Of course, rather than responding to this as they should, by admitting it was a bad idea, ES&S sends out their PR people to say it's no big deal. While ES&S is right that it might not always be possible to do an exact match person to person, you can come pretty close -- and that should be seen as a huge concern. Furthermore, as Ed Felten points out, the other e-voting firms aren't much better, and Diebold (or Premiere, or whatever its new name is) appears to be outright lying skirting the truth when it claims that its paper trail doesn't include timestamps (update:: Ed Felten points out that the Diebold ballots don't have a time stamp, but the electronic records do). It's not hard to see how this happened, but the continued denial and stonewalling from the e-voting companies, rather than admitting a mistake was made and explaining how they're going to fix things, really is troubling.

Following the release of the various independent security reports last week on the e-voting machines used in Californa, the Secretary of State needed to decide by Friday night whether to keep the machines in use in the state. At 11:45pm, she decided to decertify the machines only to immediately recertify them if they made some security changes. Of course, it seems like the changes are simply patches, and as the original report noted, many of the security problems the machines have is because all of the security they've implemented was patched on as an afterthought. Until the machines are designed from the ground up with security in mind, it's not likely to really fix many of the vulnerabilities. But, in the meantime, there's an election coming up, and apparently a bunch of major security problems are no reason to get rid of the expensive e-voting machines the state has already purchased.

Back in March, California decided that after years of negative publicity about the security of e-voting machines (and certainly enough evidence to suggest they weren't very secure) that it would allow independent security experts to try to hack into any machine before it got approval to be used in California elections. Those researchers have gone ahead and found that every machine they tested was hackable -- often very easily. The researchers were able to hack into Diebold, Sequoia and Hart InterCivic machines. They didn't get a chance to test ES&S machines because, as you may recall, ES&S stalled before handing over their source code (and included a nasty threatening letter with it). To be fair, these machines were tested in non-normal conditions, where the researchers had access to all sorts of documentation, the full source code and no election going on where people might spot them tampering with a machine. That is, this doesn't mean that it's necessarily easy to hack an election. It just means that all of the machines have some insecurities -- most of which we didn't know about before. The key here is that we can now understand these insecurities and whether or not they're adequately protected by other measures. What still doesn't make sense is why the e-voting firms are so against this process. All it's really doing is helping those companies improve their products to make them more secure. Of course, one key reason is that the researchers found that many of the security problems are because the machines weren't built with security in mind -- but only had it added as an afterthought. In other words, these companies probably should be redesigning their machines from scratch, which they don't want to do. Of course, does it worry anyone else that the machines weren't designed with security in mind in the first place?