Blog Post

Dec 09

It Is Time to Get Rid of Black Box Voting

Dallas County like much of Texas has very real problems with our current voting systems. After three years of diligent effort, we strongly believe that our current generation of voting equipment and processes have failed to win the trust of a large part of the public. We have tried to work with these systems but no longer think that these can be made trustworthy.

We strongly believe that we can’t put our votes at risk any further.

We simply must get opaque voting systems (those that are not transparent) out of our election systems. That means no machines with modems or internet connections of any kind.

All opaque voting systems must go. Counties all over Texas, particularly in the large counties, embraced these new machines and merely accepted their opaque aspects because of the rush to get away from the “hanging chad” situation of the very old punch card systems.  Unfortunately, we threw the baby out with the bath water. Counties that used hand-marked paper ballots and OCR scanners did not have the punch-card issues but were changed anyway. In the rush to get rid of hanging chad possibilities, we got rid of transparency by embracing opaqueness. That was not a good trade, and it is time to correct it.

Correcting the problem likely means going back to hand-marked paper ballots that are counted and reported in the precinct. It also means returning to precinct voting using paper pollbooks. At the end of the evening, hang up a results report for that precinct on the front door of the precinct so everybody can see. Take the voting media (ballots and USB drives) to central count to be accumulated and reported from a simple tabulator that is only connected to electricity and that is open and can be inspected. We can even keep 462 Election Day polling locations in the county if desired just as long as everything is transparent. We would continue to have representatives of each political party in each location to provide the needed checks and balances.

The results would be an entire system that is air gapped. Nothing in the voting system should have any connectivity at all.

For years, in the recent past, we have done this and had completed counts by the end of the evening on Election Night. Entire countries such as France and England use systems much like this and are able to timely report results.

The Dallas County Republican Party is calling for the 88th Session of the Texas Legislature to consider and pass legislation to make transparent and trustworthy voting happen again.

We think we have a good case for this position. It is measured and reasonable. The core of the argument is that the current voting system lacks trust, lacks transparency, is highly complex and has poor performance.

Our Case for Removing Opaque Voting Systems

Our current generation of voting systems is called black box voting. The name “black box” derives from a common concept used in engineering, science and computing. Black boxes are processes that happen in a box (which can be both physical and software) that apply programmed logic to what is put into the box. Black boxes are described solely in terms of their input and output without any knowledge of their internal workings. You input something into the black box, the black box whirs for a moment and the black box outputs something,

The inner workings of such boxes are completely opaque and therefore called black. We don’t know what goes on inside the boxes. It is un-knowable without access to the internal logic.

When the term “black box” is applied to voting systems (“black box voting”) the input into the box is cast ballots. The output of the box is the election results.

Being opaque does not lend itself to trust since we don’t know how the votes are counted. We also don’t know about the current system's resistance to cyber tampering and interference.

What gets us into trouble is that the companies that sell voting systems use propriety technology of their own inventions to build these systems. Along with patents, they also make copious use of “trade secrets” to protect their software and firmware from disclosure to their competitors (and us) and loss of competitive advantages in the marketplace.  Yes, it is reasonable as far as their commercial interests go but it also, some would say conveniently, denies voters knowledge of what happens inside the black box.

Inherently, opaqueness and secrecy are not good things in voting. Voters are asked to trust something as important as voting to vendors who assure us that their machines are safe but cannot openly demonstrate it. "Trust us" no longer plays well with voters for election matters.

In 1923, Soviet strongman Joseph Stalin famously said, “I consider it completely unimportant who in the party will vote, or how; but what is extraordinarily important is this—who will count the votes, and how.”

Good point, Joe.

Black boxes, with their internal operations that are kept secret from voters, do not engender trust beginning at the very start. The vendors who make these systems submit their work to one of several national testing organizations. However, the test process itself isn’t fully disclosed so we don’t know the rigor used in their inspections; the use of trade secrets blocks full disclosure. The testing lab writes reports of their findings within the non-disclosure of the trade secrets involved and usually opines that the systems are safe. To sell the voting systems in Texas, the vendors are then required to have their offerings reviewed by the Texas Secretary of State and approved. But the Secretary of State mostly relies on the summary reports of the testing labs and reviews of the vendors’ operational manual.

In the end, we are forced to take the word of only third parties that the internal workings of these black boxes produce faithful and unmanipulated results.

Stalin would approve!

The output of these black box voting systems requires us to put a lot of trust into the internal working of the boxes and because of opaqueness, regular voters like you and me can’t see how they work. Even more troubling, neither can our election professionals in our departments of election; they too are required to take the word of other people, mostly the vendors, and can only parrot the standard answers they are given. They too don’t get to inspect what goes on in the black boxes either.

In a county as large as Dallas County with hundreds of ballot styles and 1.4 million registered voters, the functions of the black box are complex as is the whole system that accumulates the results of our elections. From each Voting Center, voting results are transferred to Central Count at Dallas County Elections via USB drives. The USB drives are supposed to be completely air-gapped from networks and the Internet which is assuring. But, in turn, the contents of the USB drive are input into a computer running the vendor’s accumulator software at Central County which are connected to a vendor’s Election Management system that is based in the cloud. Yep, more black boxes talking to other black boxes and most critical systems above the USB drives are Internet-connected. All are equally opaque. We now are forced to accept that the information security used to protect the vote is better than the hackers and bad actors who would want to manipulate or interfere with the vote. That is a bit much to ask based purely on faith.

As for output from the black box, all that most people see is only a summary report for each race. You can drill down and get a precinct-by-precinct report broken out by ballot style. However, that’s it; that is all we get.

One voter who is a critic of the system recently told us that all he knows is that he puts his voted ballot into the tabulator and then waits for the government to tell him who won. Basically, that is a realistic and accurate view of what happens.

For many of us, there are too many unanswered questions about these black boxes and their operations that even our election departments can’t answer. The voting systems we have now are also far too complex; configuring and operating these systems and their cloud component, even complying with information technology best practices, can be technically challenging. Black boxes talking to other black boxes with almost total opacity offer too many points of failure and too many opportunities for security to be compromised. We don’t see proper checks and balances disclosed.

The new Section 127 Randomized County Audits that SB-1 added to the Texas Election Code was a political compromise in the Texas Legislature 87th Session in a well-meaning effort to build confidence that the black boxes could be trusted. Unfortunately, the process as it was implemented after all the various interpretations of the new law, is completely inadequate for the stated purpose. The sample sizes of the audits were far too small and the technique by which they are conducted is questionable as well as partially opaque. That was unfortunate.

It was a noble effort, but sadly, it didn’t provide the trust that was intended and so desperately needed. We are still just as unsure of the black boxes now as ever.

Further, as if using black boxes in marking and casting ballots wasn’t bad enough, in Dallas County we tried county-wide voting at the same time we implemented black box voting. Rather than voting in our home precinct as we have for decades, any Dallas County voter can walk into any of our 52 Early Voting Centers or 462 Election Day Voting Centers and vote. To implement the concept, network-centric county-wide pollbooks are needed that contain all of the people in Dallas County that are registered to vote. The new e-pollbooks are more black boxes.

Unfortunately, even the best of the current e-pollbook system has not been up to the job. Our current e-pollbook is the second system we have tried. The first e-pollbook system was replaced rather quickly. In the three years that we have experimented with county-wide voting with e-pollbooks, they simply don’t work as desired or as advertised.

One of the functions of e-pollbooks is to prevent one possible scenario in county-wide voting where a person votes in one Voting Center and drives to another Voting Center and votes again (repeaters.) In theory, e-pollbooks are all networked to the Dallas County Elections Department central database. When a voter checks in and is issued a ballot, it is recorded in the central database for the record of that voter and that voter can’t be issued a repeat ballot. All well and good so far. One of the real-world problems is that the e-pollbooks won’t stay online all day. If they drop offline, they have a built-in feature that allows them to still operate as a self-contained island disconnected from the central database. While they are offline, they can’t catch the repeating voter issue. In theory, when the e-pollbook reconnects, it will resynch with the central database but if a repeating voter has voted again while offline, how can anyone find the already-cast secret ballot and cancel it?

Too many e-pollbooks won’t stay consistently online because their connectivity fades in and out all day long. The connectivity brownouts don’t entirely behave like the problems are entirely network issues but possibly within the e-pollbooks themselves. At the times one of the e-pollbooks drops offline, it can be sitting right next to other fully-functional e-pollbooks. This behavior doesn’t add to our confidence. Trust is further eroded because too high a percentage of e-pollbook simply are D.O.A. as we set them up before voting. They never get online. On election days, the overworked technicians of Dallas County Elections can’t get to us to fix them.

I might consider saying, “At least when they are working, they work well” but I can’t even say that. This year, we had multiple well-documented cases where the number of checked-in voters fluctuated at the end of the day.  We are supposed to check the number of voters that checked in and were issued ballots on the e-pollbook. Those numbers should match the number of voters recorded on the paper check-in roster. The total of the checked-in voters should match the number of cast votes on the tabulator. This check is very basic. Not being able to perform it shakes the faith of our Election Workers and should alarm us.

If the e-pollbook numbers show the number of checked-in voter float, sometimes widely, it greatly erodes our confidence in the system.

These black boxes, particularly poorly functioning black boxes, do not engender trust in voting.

Ironically, e-pollbooks that contain all registered voters have surfaced another issue: dirty voter rosters. When an Election Clerk checks in a voter and their Texas Driver License doesn’t scan, we must do a manual search for the voter. When we enter their name, there is a disconcerting number of times that of multiple records are being found for the same voter, cases of multiple records with the same full name, address, and date of birth.

There is a little exercise we’ve done with this issue across several elections. Five elections ago, we found a voter with four records in the e-pollbook for the same person. All four were the same complete name and at the same address. Two had the month and day digits of their date of birth flipped (month and day) from what looks like a simple typo. Each of the four records had its own VUID (voter unique identification number). Since we found this in the first election, we check his name in every election just to see what happened. Although these duplicates have been reported, his multiple records still appear in the e-pollbook in duplicate. I’m happy to report that finally in the November 8th election, he was down to only two duplicate records instead of the usual four. Progress, I guess.

We see enough of these situations in voting operations that it begs the question, “Just how clean is the Dallas County Voter File?” and “Does the Dallas County Voter File that we can download via a FOIA request match (adjusting for very recent changes) the database in the e-pollbooks?”

The voter roster is, in essence, also a black box process; we put in a name search and get out multiple duplicate records. We don’t fully know what happens inside the black box. Yes, we know the desire is to broaden the base of voters and energetically support voter registration efforts. But at what point does the database get cleaned for of dupes, dead voters, people who have moved out of the jurisdiction and phantom voters? Clean voter rolls that keep all legal potential voters intact, is the first line of defense against phantom voters.

Cleaning voter rolls should not use voter suppression techniques. But I am talking about using legal, fully transparent to all parties and computationally-valid ways (coupled with proper conformational fieldwork), to clean the voter role and keep it clean.

All black box voting must go. It would be nice to think that we can make these highly opaque voting systems transparent and safe, but their opaqueness is just too ingrained and fundamental to the way these vendors function. After three years of trying to work with this equipment, it is time to say “Enough!” and move to something much simpler and fully transparent.

The opposite of a black box is a system where all its internal components and logic are available for inspection and testing by anybody who cares to spend the time to do it. Rather than “black box” systems, these are called “glass box” systems because they are totally transparent.

This blog focuses entirely on the black box portion of the current voting system. So, you might be thinking, “What about these pre-numbered sequential ballots we have been so proud to have obtained?” They would be great and a complete check of the election – if we had an election contest in which a candidate was able to secure a court order from a judge of competent jurisdiction to examine and count those ballots.  Yes, that is what it would take.  And, for Dallas County candidates (not state or federal), that means a Dallas County District Court (and thus, the significance of an all-blue judiciary – stayed tuned for a blog soon about the difficulty in recruiting judicial candidates!).  Do not get me wrong.  The pre-numbered sequential ballots remain an important part of election integrity.  But without transparent processes that eliminate all darkness in between, they are not enough

It is time to embrace glass box voting.

Added by RTex

This is an absolutely great article and hits the nail dead center, something our elected leaders have not heretofore been willing to do. We clearly have new leadership in the Dallas GOP, and this represents great hope!!
Added by Roy Getting

Great blog post. You did forget to mention that the early vote ballots were not numbered nor signed. This is a huge opportunity for mischief.
Added by Barbara King

I think you are tilting at windmills. I've worked elections (and poll watcher) for the last 10 years and have encountered many problems, none of which were on voting day. If the poll book and paper lists don't add up, it's usually a clerical error. I've never seen a pollbook go offline. That is the only thing that is attached to the internet. What I did notice this time that seemed a problem (a complaint was filed) is that the ballot marker printed out a barcode instead of the name of the candidate. Always before, you could actually check your choices on the ballot, itself.
What I see as a problem is the early voting at nursing homes. The residents are "helped" to vote by an administrator. Some states require a special team of one democrat and one republican to go as a team to help people vote in care homes.
Another problem I see is that many of the "community" associations (NGOs) are funded by the federal government, but are mostly Democrat leaning. They facilitate voter registration, early voting and vote by mail.
Another problem I see is that Democrats just do a better job than Republicans. They know who their voters are. They keep lists, so that if you're out working on "get out the vote", you don't waste your time with people who aren't Democrats. Candidates visit the churches (yes, I know it's not legal). Churches take people to the polls.
There may be problems with the "black box" voting. There are far more problems than the "tabulator".
Barbara King
Added by Bill Anderton

Barbara, as far as the pollbooks, your experience is lucky. As a Presiding Judge, I have personally had both e-pollbooks that were D.O.A. (never came up) as well as ones that wouldn't stay connected (cloud icon turn red for periods of time) throughout the day in elections since the Primary. I didn't see it as much in the 2020 cycle so it appears to be a growing problem. Another problem that isn't mentioned above with the e-pollbooks is that the USB ports that connect the ballot printers are cheap and are wearing out much too soon for equipment this young. This causes the printer can drop out while checking in a voter that is difficult to correct if it occurs at a certain point in the check-in process. This isn't just bad USB cables but the ports in the e-pollbooks themselves.

Unreliable counts out of the e-pollbooks are a whole different issue and new this year. This wasn't counts being off by a small number from simple clerical errors on sign-in rosters. On election night, we started getting lots of reports that the total number of checked-in voters shown on e-pollbooks was wildly jumping around (floating dynamically), including showing totals off by hundreds and some cases by a thousand or more. We returned from the watch party to reopen our ops center at HQ so we could collect sworn affidavits from judges (Presiding and Alternates) that personally experienced the problem. This would seem like a "tall tale" until one Presiding Judge documented it with a video showing it happening as it occurred. I have seen the video and it is disconcerting. To their credit, DCED was worried too and immediately secured the paper ballots and paper sign-in rosters in a secure room under a guard to protect the vote. The Election Integrity Committee is documenting the scope and scale of the problem now and should be able to report soon. This wasn't an isolated instance but one that occurred in multiple Voting Centers.

I wholeheartedly concur with this article and its position on the problems of blackbox voting. The core issue is getting election results we can trust and the transparency of what happens inside the blackboxes not just in Voting Centers but in Central Count and its cloud systems too. "Trust me, they are safe" doesn't cut it.

But also, you I agreed with you totally that there are more issues than are covered in the limited scope of this article and its formal call for legislation to ban blackbox voting. Beyond blackbox voting, we also have to do a much better job of not only turning out our Republican voters but those swing/independent voters who support our candidates as you suggest. As a Precinct Chair with several large retirement centers in my precinct (about one-third of all of the registered voters in my precinct), I am well aware of the "assistance" that can be given to the residents. I agree that we need better protections in this area and that legislation might also be required.
Added by patriotmc

If something is electronic (powered by electricity), it can still be made vulnerable to manipulation, REGARDLESS.
1. Anything electronic can be manipulated wirelessly (wifi, bluetooth, cellular, any type of radio).
2. Even a blinking visible or invisible light can be used to transmit/receive digital data (think TV remote controls).
2. Anything electronic can have hidden code in it that many Americans would not be able to understand or detect. Because it is not transparent, it cannot be used.

The cold hard truth is, we can ONLY use a system that EVERY American can see 100%, understand 100%, and verify 100% by themselves without having to blindly believe/trust any government or other entity. Elections BELONG to US, not our government, and not private private companies.

If you can't see it, then someone out there can hide something in it. Accept nothing less than 100% TRANSPARENCY.
We're sorry. New comments are no longer being accepted.
5 people will be notified when a comment is added.
Would you like to be notified when a comment is added?
Please login or register first.