In 1988 Ronnie Dugger wrote the definitive article
on vote fixing. Much of what we saw in Florida in 2000 was covered
in his article, almost as though someone used it as a guide. It's
never before been on the web since it predates the internet.
But here it is, digitized.
Save it to your hard drive. Put it on your own
Email it to everyone you know.
ANNALS OF DEMOCRACY
By Ronnie Dugger
The New Yorker, November 7, 1988
DURING the past quarter of a century, with hardly
anyone noticing, the inner workings of democracy have been computerized.
All our elections, from mayor to President, are counted locally,
in about ten thousand five hundred political jurisdictions, and
gradually, since 1964, different kinds of computer-based voting
systems have been installed in town after town, city after city,
county after county. This year, fifty-five per cent of all votes-seventy-five
per cent in the largest jurisdictions-will be counted electronically.
If ninety-five million Americans vote on Tuesday, November 8th,
the decisions expressed by about fifty-two million of them will
be tabulated according to rules that programmers and operators unknown
to the public have fed into computers.
In many respects, this electronic conversion has
seemed natural, even inevitable. Both of the old ways -- hand-counting
paper ballots and relying on interlocked rotary counters to tabulate
votes that are cast by pulling down levers on mechanical machines
-- have been shown to be susceptible to error and fraud. On Election
Night, computers can usually produce the final results faster than
any other method of tabulation, and so enable local officials to
please reporters on deadlines and to avoid the suspicions of fraud
which long delays in counting can stimulate.
Recently, however, computerized vote-counting has
engendered controversy. Do the quick-as-a-wink, computerized systems
count accurately? Are they vulnerable to fraud, as well, even fraud
of a much more dangerous, centralized kind? Is the most widely used
computerized system, the Votomatic, which relies on computer punch-card
ballots, disenfranchising hundreds of thousands of voters?
It appears that since 1980 errors and accidents
have proliferated in computer-counted elections. Since 1984, the
State of Illinois has tested local computerized systems by running
many thousands of machine-punched mock ballots through them, rather
than the few tens of test ballots that local election officials
customarily use. As of the most recent tests
this year, errors in the basic counting instructions in the computer
programs had been found in almost a fifth of the examinations.
These "tabulation-program errors" probably
would not have been caught in the local jurisdictions. "I
don't understand why nobody cares," Michael L. Harty, who was until
recently the director of voting systems and standards for Illinois,
told me last December in Springfield. "At one point, we had
tabulation errors in twenty-eight per cent of the systems tested,
and nobody cared."
Robert J. Naegele, who is the State of California's
chief expert on certifying voting systems and is also the president
of his own computer consulting firm, has been hired by the Federal
Election Commission (F.E.C.) to write new voluntary national standards
for computerized vote-counting equipment and programs. Last spring,
in San Francisco, at a national conference of local-election officials,
I asked Naegele whether computerized voting as it is now practiced
in the United States is secure against fraud.
He pointed a thumb at the floor.
"When we first started looking at this issue, back in the middle
seventies, we found there were a lot of these systems that were
vulnerable to fraud and out-and-out error," he said.
I asked him whether he regarded as adequate the
typical fifty-five-ballot "logic-and-accuracy public test" that
is conducted locally on the Votomatic computerized punch-card vote-counting
system-which about four in ten voters will use on November 8th-and
he said, "No."
Would such a test discover,
for example, a "time bomb" set to start transferring a certain proportion
of votes from one candidate to another at a certain time, or any
other programmers' tricks?
"Of course not," Naegele
said. "It's not a test of the system. It's not security!"
The old mechanical machines prevent citizens from
"overvoting"-voting for more candidates in a race than they are
entitled to vote for-but the Votomatic systems do not. Not only
can people using these systems overvote but election workers, if
they are dishonest, can punch extra holes in ballots to invalidate
votes that have been correctly cast or to cast votes themselves
in races the voter has skipped. In the 1984 general election, about
a hundred and thirty-seven thousand out of a total of 4.7 million
voters in Ohio did not cast valid ballots for President-mostly,
according to Ohio's secretary of state, because of overvoting. The
computerized punch-card voting system is "a barrier to exercise
of the franchise," and causes "technological disenfranchisement,"
Neil Heighberger, the dean of the College of Social Sciences at
Xavier University, in Cincinnati, concluded in a recent study he
made of the subject.
A federal judge, William L. Hungate, ruling last
December on a lawsuit in St. Louis, declared that the computerized
punch-card voting system as it has been used in that city denies
blacks an equal opportunity with whites to participate in the political
process. The suit was filed by Michael V. Roberts, a black candidate
for president of the Board of Aldermen who in March of last year
had lost to a white by a fourth of one per cent in a city election
in which voting positions on ballots in the black wards were more
than three times as likely not to be counted as those in white wards.
Roberts, who was joined in the suit by the St. Louis branch of the
National Association for the Advancement of Colored People, contended
that computerized voting is such a relatively complex process that
it is tantamount to a literacy test, and literacy tests have been
prohibited by federal law as an unconstitutional burden on the right
to vote. Judge Hungate
found that in four local elections since 1981 voting positions had
not been counted by the computerized system on anywhere from four
to eight of every hundred ballots in black wards, compared with
about two of every hundred in white wards (and also
found that in the March, 1987, election the computerized returns
from six per cent of the precincts had "irreconcilable discrepancies").
The evidence indicated that the computer had passed over the uncounted
positions because of either overvoting or undervoting, which is
failing to cast a vote in a race. The Judge ordered officials
to count by hand all ballots that contained overvotes or undervotes
and to intensify voter education in the black wards, but the city
appealed, arguing that the racial differential does not always hold
true in the city's elections. The Missouri secretary of state, Roy
Blunt, called the order to recount the ballots by hand unfair and
said that it could "make punch-card voting unworkable."
In Pueblo, Colorado, in 1980, suspicions about
the vote-counting on punch-card equipment led to an investigation
by a computer expert, but nothing was proved.
In Pennsylvania, in 1980,
two of three examiners recommended that the Votomatic punch-card
system marketed by Computer Election Services (C.E.S.), of Berkeley,
California, be rejected, on the ground that it was fraud-prone,
but the secretary of the Commonwealth of Pennsylvania approved it
anyway. In Tacoma, Washington,
in 1982 and 1987, in the only known local referendums on computerized
voting, citizens' crusades, led by a conservative Republican, Eleanora
Ballasiotes, that focused on the vulnerabilities of computers to
fraud resulted each time in the voters' three-to-one rejection of
the systems that their local officials were about to buy.
A group of defeated Democratic candidates in Elkhart, Indiana, sued
local election officials in 1983, alleging that computer-based
irregularities had occurred in a 1982 election; they have since
lost three lawsuits, and a fourth one continues. In Dallas, Terry
Elkins, the campaign manager for Max Goldblatt, who in 1985 ran
for mayor, came to believe, on the basis of a months long study
of the surviving records and materials of the election, that Goldblatt
had been kept out of a runoff by manipulation of the computerized
voting system. The attorney general of Texas, Jim Mattox, was impressed
by the charges and conducted an official investigation of
them. Dallas authorities have declared that since there is no evidence
of criminal behavior the case is closed, but Mattox has refused
to close it. "I do not think that there were adequate explanations
for the anomalies," he told me, in Austin.
COMPUTER programmers working for the private companies
that sell election equipment write their programs in higher computer
languages or the intermediate assembly language, and these are translated
or compiled into the binary language of ones and zeros which computers
understand. The original programs, which are
centrally produced, are commonly called "source codes;" only
a few local governments own and control the source codes that are
used in their jurisdictions. According to Jack Gerbel, a
founder of C.E.S., who has sold more computerized vote-counting
equipment than any other individual in the country, about half the
time the companies' programmers also write the codes that "localize"
(or "initialize") vote-counting systems for the specific elections
of each jurisdiction. The source and local
codes together tell the computers how to count the votes. Local
public tests may or may not adequately test the local codes, but,
as Naegele said, they do not test the source codes.
The election-equipment companies,
which thus both sell and program the computers that tabulate public
elections, have long contended, in and out of court, that they own
the source codes and must keep them secret from everyone, including
the local officials who conduct elections.
n 1985, Jack Kemp (no relation of the congressman),
the president of C.E.S., which was then the leading election-equipment
company in the country, warned in so many words that an outsider
who got the company's source code could compromise elections with
it. Through an affidavit that Kemp furnished for a lawsuit in Charleston,
West Virginia, the company affirmed that the security of the vote-counting
in C.E.S.equipped jurisdictions depended in large measure on its
retention of the secrets of the code, and that there would be "a
grave risk" to this security if the defeated candidates were permitted
to see the code. "The significance of the company's proprietary
interest in its software is incalculable from our perspective,"
That significance is incalculable from the voter's
perspective, too. Insofar as source codes have not been opened to
examination on behalf of the public-and most have not-instructions
to computers on how to count votes appear to have become a trade
secret. Only a few states have demanded copies of the source codes,
and only in the last year or two have any states examined them.
Thus most of the
local officials who preside over computerized elections do not actually
know how their systems are counting the votes, and when they officially
certify that the election results are correct they do not and cannot
really know them to be so.
After systems that use computer punch cards as ballots have counted
the votes, manual recounts of the holes in the punch cards can be
demanded, provided the cards have not yet been destroyed by local
officials-as is permitted by most local laws after a specified period
of time. But in a new computerized system,
"direct-recording electronic" (D.R.E.), which is becoming more widespread,
there are no individual ballots, and, the way these new machines
are now being used in many jurisdictions, recounts are impossible,
for the program destroys the electronic record of each voter's choices
the instant after it counts them.
The dominant company now in the sale and programming
of computerized vote-counting systems for public elections, Cronus
Industries, of Dallas, is better known as its sole and wholly owned
subsidiary, the Business Records Corporation (B.R.C.). Cronus/ B.R.C.
has accused the R. F. Shoup Company, of Bryn Mawr, Pennsylvania-one
of its rivals for a fortymillion-dollar voting-equipment order from
New York City-of infringing B.R.C. patents in the very D.R.E. vote-counting
machine, the Shouptronic, that Shoup is trying to sell to New York.
In a lawsuit filed last November in Philadelphia, Cronus, on whose
equipment between thirty and forty-five million votes will be counted
this year, has also sought to discredit Shoup, on the basis of a
1979 conviction of Ransom Shoup II, the president
of the company, of two federal felonies-conspiracy and obstruction
of justice-in connection with an F.B.I. investigation of an election
in Philadelphia that had been counted on mechanical-lever machines.For
these offenses, Ransom Shoup was fined ten thousand dollars and
given a three-year suspended sentence. Counterattacking, the Shoup
firm, whose equipment will tabulate an estimated million and a half
votes on November 8th, has accused Cronus of reaching for "a virtual
monopoly on the entire business of supplying voting equipment for
use in political elections in the United States" and has
alleged that the Cronus vote-counting systems that are in use "inherently
facilitate the opportunity for various ... forms of fraud" and "create
new and unique opportunities for fraudulent and extremely difficult-to-detect
manipulation and alterations with respect to election results."
In 1985 and 1986, Cronus bought Computer Election
Systems and also eight smaller election-equipment and election-printing
firms, while selling off three other subsidiaries, thereby transforming
itself, in eighteen months, from a small conglomerate of disparate
industrial businesses into the titan of the computerized-vote-counting
Cronus is now responsible for most C.E.S. systems
that are still in service and for a computer-based "mark-sense"
voting system that B.R.C. has sold in the past few years. B.R.C.
also sells computerized voter-registration systems; election supplies,
including, this year, perhaps a hundred and sixty million punch-card
ballots; election assistance and service; and other computerized
information services for local governments. C.E.S. used to take
pride in publicizing the millions of votes cast on its machines
(a total of three hundred and fifty million between 1964 and 1984),
and after Cronus bought C.E.S., in 1985,
C. A. Rundell, Jr., then the chairman and chief executive officer
of Cronus, told a reporter that his company had about forty per
cent of the election-service market.But when I asked
Rundell earlier this year how many votes Cronus systems will count
in 1988 and in which jurisdictions, he refused to say. "We certainly
are not going to provide you with a list of customers and the kinds
of systems they have," he declared. "We've got to ask how much competitive
intelligence we divulge to our competition." He did volunteer that
the total for votes counted by Cronus systems was below thirty-five
million. Officials at R. F. Shoup, however, seeking to prove that
Cronus is a monopoly, charge that Cronus systems will count fifty
or sixty million votes on November 8th. In any case, Cronus and
C.E.S. systems are used by the voters in such cities as Los Angeles,
Chicago, Detroit, Houston, Phoenix, Miami, Seattle, Minneapolis,
Cincinnati, and Cleveland.
On Election Day, about one in every three American
voters still pulls down the lever on an old thousand-pound mechanical-lever
machine, and about one in every nine still marks the old-fashioned
paper ballot that is counted by hand. In the past two years, however,
more than eighty United States counties have abandoned lever machines,
and more than ninety have abandoned paper ballots, the replacements
being in most cases either D.R.E. or mark-sense systems. In mark-sense
systems, which are also called "optical-scan," computers employing
light or electrical conductivity count votes that have been cast
on ballots with pencils or markers. Mark-sense is now used by about
eight per cent of the voters; a multi-punch-card, count-the-holes
computer system called Datavote, which is sold by Sequoia Pacific
Systems Corporation, of Exeter, California, is used by about four
per cent; and electronic D.R.E. systems, the newest computerized
voting technology, are used by about three per cent. "The election
business is shifting into the mark-sense and the electronic [D.R.E.]
stuff," according to Richard J. Stephens, the president of a small
election company in Escondido, California, who has been in the field
since 1966. "The punch-card systems will remain out there, but B.R.C.
is not trying to sell punch-card anymore-it's selling mark-sense
THE private business of counting votes in public
elections can be realistically understood only as a small, if extremely
important, segment of the computer industry itself, and thus a business
that has both the strengths and the weaknesses of the over-all industry.
The computer industry's strengths-astoundingly vast and rapid computational
power, the automation of trillions of transactions have been well
known for some time, but the weaknesses have come to be understood
only lately. In recent years, the vulnerability of computers to
tampering and fraud has become a commonplace in many industries.
Computer operators do not leave fingerprints
inside a computer, the events that occur inside it cannot be seen,
and its records, and printouts can be fixed to give no hint of whichever
of its operations an operator wants to keep secret.
The practical problem of the computer age is invisibility.
Hackers-adventurous programmers-penetrate corporate and governmental
computers for fun and jimmy the programs in them for gain. "Electronic
cat burglars" have stolen billions of dollars from banks and other
businesses-a billion a year by a recent estimate of the American
Bar Association. By means of computer fraud employees have raised
their salaries and students have raised their grades. Caltech students
printed out more than a million entry blanks for a McDonald's contest
and won a Datsun station wagon. Employees of a federal agency diverted
tens of thousands of dollars to nonexistent employees. In the infamous
1973 Equity Funding Corporation fraud, company officials and other
employees typed into their computers names of about sixty-four thousand
people who didn't exist as holders of more than two billion dollars'
worth of life-insurance policies that didn't exist but were "resold"
to reinsurers. "Electronic dead souls," the writer Thomas Whiteside
has called these fabricated customers.
Whether or not elections have ever been stolen
by computer before, some citizens and some officials are asking
if it could happen in the future. Could
a local or state office or a seat in the United States House of
Representatives be stolen by computer? Might the outcome of a close
race for a United States Senate seat be determined by computer fraud
in large local jurisdictions?Since,
under the state-by-state, winner-take-all rules of the electoral
college, a close Presidential election can be decided by relatively
few votes in two or three big states, could electronic illusionists
steal the Presidency by fixing the vote-counting computers in just
four or five major metropolitan areas?Could
people breaking into or properly positioned within a computerized-vote
counting company, acting for political reasons or personal gain,
steal House or Senate seats, or even the White House itself?
Randall H. Erben, the assistant secretary of state in Texas, who
served as special counsel on ballot integrity to President Ronald
Reagan's campaign in 1984 and, in 1986, headed a similar group for
Governor Bill Clements, of Texas, told me in Austin,
"I have no question that somebody who's smart enough with a computer
could probably rig it to mistabulate. Whether that has happened
yet I don't know. It's going to be virtually undetectable if it's
done correctly, and that's what concerns me about it." Willis
Ware, a Rand Corportion computer specialist, warned those attending
a 1987 conference on the security of computer-tabulated elections,
"There is probably a Chernobyl or a Three Mile Island waiting to
happen in some election, just as a Richter 8 earthquake is waiting
to happen in California." The chief
counsel of the Republican National Committee, Mark Braden, told
me that he has yet to see a proved case of computer-based election
fraud, but added, "People who work for us who know about computers
claim that you could do it."
concerned with elections think about the unthinkable in their field;
namely, the stealing of a Presidential election by computer fraud
in the vote-counting in metropolitan areas of key states. Steve
White, the chief assistant attorney general of California, said
to me last spring in Sacramento, "It could be done relatively easily
by somebody who didn't necessarily have to be all that sophisticated.
Given the importance of the national election, sooner or later it
will be attempted. There is a real reluctance to concede the gravity
of the problem."
Jim Mattox, the Texas attorney general, while discussing
Cronus/B.R.C./ C.E.S., exclaimed to me in dismay a year ago, One
thing is clear: one company in the United States should not have
as big an impact on elections as this company has got. Nobody should
have in a democracy. The right to vote is too sacred."
COMPUTERS can be ordered
to transfer votes from one candidate to another, to add votes to
a candidate's total, to determine an outcome in accordance with
a specified percentage spread. All the computer experts I have spoken
with agreed that no computer program can be made completely secure
against fraud.Where they differed was in their characterizations
of this fact. Local election officials and election equipment-company
specialists, executives, and salesmen usually took the position
that state certification procedures and local logic-and-accuracy
tests provide enough security for reasonable assurance that elections
are honestly counted. The independent computer specialists I interviewed
were divided, generally speaking, into two camps. One, led by Roy
Saltman, of the National Bureau of Standards, Robert Naegele, and
Lance Hoffman, of George Washington University, sees local-election
theft by computer as possible, but stresses the fact that no case
of program tampering has been proved. This camp attributes the manifold
problems of computerized vote-counting entirely or almost entirely
to inadequacies in the administration of elections and insufficient
testing of the equipment, and regards the theft of the Presidency
by computer as, in effect, impossible. The
other, led by the Pennsylvania voting-systems examiner Michael Shamos
and the computer specialists Howard Jay Strauss, of Princeton, and
Peter G. Neumann, of S.R.I. International, a nonprofit research
institution in Menlo Park, California, emphasizes the ease of concealing
theft by computer "without a trace;" characterizes local elections
as very vulnerable to fraud; and regards the
theft of the Presidency by computer as entirely possible.
Should citizens delegate the job of vote-counting
to technicians? Most people do not know enough
about computers to be able to tell what is happening during computerized
vote-counting, even if they are looking straight at the card readers
and computers. In Dallas last year, during a conference of
citizens concerned about this issue, David T. Stutsman, an Indiana
attorney with experience in contested-election cases, said, "In
traditional elections, the people in your neighborhood, your neighbors,
had the responsibility and the legal duty to supervise an election.
They counted the votes. The precinct officials don't count the votes
anymore. The power-that is, political power-has gone to the venders,
to the venders' representatives, and to the people that operate
those machines." He also said, "You're putting more power in the
hands of fewer people."
Demands for much stricter security in computerized
elections appear to be gaining adherents in many quarters. Sometime
after the November election, results the National Clearinghouse
on Election Administration, a grandly named four-person office in
the F.E.C., will publish voluntary, but potentially influential,
national standards for the security and accuracy of computerized
elections. In a late-summer draft, the Clearinghouse proposed that
the election-equipment companies place their source codes in escrow,
the idea probably being that in the event of seriously disputed
election results the codes could be obtained and examined by representative's
of the public.
THE evolution from counting paper ballots one at
a time to counting as many as a thousand punch-card ballots a minute
occupied about seventy years-a period that can be seen as having
opened in 1892, when lever voting machines first appeared. Four
years later, Joseph P. Harris, the inventor of the Votomatic system,
was born, on a farm in North Carolina. In the First World War, Harris
was a flying instructor, and afterward he helped pay for his doctorate
in political science at the University of Chicago by flying the
mail between Chicago and Cleveland in open-cockpit planes. A favored
student of Charles Merriam, who was seeking to develop a scientific
basis for understanding politics, Harris became a teacher and a
scholar who over four decades wrote many books on politics and elections.
He refined and championed the process of permanent voter registration,
and it was largely through his efforts that permanent registration
replaced the earlier system of recurring reregistration. In the
nine-teen-thirties, drawn to Washington by the New Deal, he served
on committees advising President Roosevelt on economic-security
and administrative management issues.
Early in his career, Harris saw for himself that the politicians
in big cities stole votes easily. Touring voting places during a
Chicago election in the nineteen-twenties, he spotted a shotgun
at one precinct and also noted "a good deal of corruption that you
could see." In a 1934 book, "Election Administration," he
recounted the details of proved ballot-stuffing, repeat votes cast
by paid drunks (sometimes fifteen or twenty times), and shameless
miscounting in Philadelphia, Pittsburgh, and Cleveland, and he quoted
Boss Tweed's testimony before the Board of Aldermen in New York
City that he had routinely instructed his Tammany Hall men to "count
the ballots in bulk, or without counting them announce the result
in bulk, or change from one to the other, as the case may have been,"
and Tweed's further statements that "the ballots made no result;
the counters made the result," and "I don't think there was
ever a fair or honest election in the City of New York." During
several summers in the nineteen-twenties, Harris supervised the
installation of lever voting machines made by the Automatic Voting
Machine Company, of Jamestown, New York (he gave up the job with
A.V.M. because he felt that it tainted him somehow). He was struck
by the machines' complexity, weight, and cost, but he also realized
that the lever machines represented a big step forward in a long
process. People had voted with kernels of corn or black and white
beans in Massachusetts in the sixteen-forties, viva voce or by a
show of hands in pre-Revolutionary times, and on paper ballots that
they wrote out for themselves or had written out for them, then
on printed ones, then on the secret and official printed
"Australian" ballots that were adopted generally in the second half
of the nineteenth century. When a voter using the mechanical machine
presses down a lever beside a printed choice, the return of the
lever to its original position causes a tenth of a turn on a tens
counter, which is connected to a hundreds counter. A.V.M. was the
first large firm in the field. Samuel R. Shoup, the grandfather
of the president of the present R. F. Shoup Company, organized the
principal rival to A.V.M., the Shoup Voting Machine Corporation
(S.V.M.), in 1905.
By 1928, a lever machine was used by about one of every
six American voters. In the early thirties, while he was a professor
of political science at the University of Washington, Harris began
to have constructed in the university's engineering shops a gizmo
that he thought of as the application of the principle of the player
piano to the mechanical voting machine. ("The computer was beyond
my dreams," he said later.) One voted on Harris's device by depressing
keys that made perforations in a paper roll, and in due course the
machine would automatically count the perforations and print the
results. A Seattle businessman went halves on it with Harris, and
in 1934, after much difficulty, the moonlighting professor
won a patent, but by then he understood that financially the project
was far beyond him and his friends. He invited "the I.B.M.," as
he called the International Business Machines Corporation, to develop
and market his device, but, in 1937, the company turned him
down. On the eve of the Second World War, he was still tinkering
with the machine-considering entering votes on the paper roll as
lead marks that could be read electrically, or even, as he wrote
to I.B.M.'s director for market research in 1939, "on a punch
For Harris, as for nearly everyone, the war intervened,
and he taught management and administration at a school for military
officers. One day in the early nineteen-sixties, though, when he
was teaching at the University of California at Berkeley, a former
student asked him if he had ever thought of using a standard I.B.M.
computer punch card for vote-recording. "I hadn't, but I did," Harris
wrote later; he had forgotten his own idea of 1939. Soon
after he had been asked about the I.B.M. card, the election chief
of Alameda County, California, complained to him that the lever
voting machines could barely handle the current ballots, which kept
growing longer. "Joe," he said, "what we need is some kind of a
simple mechanical device that can be related some way to a computer."
In that context, the election official talked about the I.B.M. Port-a-Punch,
a hand-held device for punching out the rectangles on the I.B.M.
card. "I started to think," Harris said later. After a cataract
operation in 1962, as he lay bedridden for two weeks with pads taped
over his eyes, he had a eureka experience: he suddenly visualized
"a computer card in an inexpensive holder with a permanent election
`book' pre-marked with candidates and issues."
The founding president of C.E.S., Robert P. Varni,
told me what happened next. We were in his apartment in San Francisco,
a twenty-third-floor Nob Hill penthouse looking out across the great
sweep of the bay, the islands, and the bridges. "I was working for
I.B.M.," he said. "One of my accounts was U.C. Berkeley. I got a
call from Joe Harris. He asked about the I.B.M. Port-a-Punch. `I
have an idea, and I'd like to borrow it for a while,' he said. He
didn't want to buy it. It was an eight-dollar item. He wanted to
borrow it, along with about a dollar and a half's worth of punch
Assisted by William S. Rouverol, a retired professor,
who was an engineer, Harris cobbled together his ingenious new device
for computerized vote counting. "After a while," Varni went on,
"he called and said, `I've done something interesting with that
Port-a-Punch you lent me.' I went to his office and he showed me
the first prototype of the Votomatic." Harris said later that he
had derived the name of his invention from the Shine-O-Matic, a
shoeshine machine he had read about in the Sunday paper.
Varni is now the trim, prosperous chairman of a
firm that computerizes police and fire departments. As he recalled
those early days, he often broke into a warm smile. Harris didn't
know anything about computers and needed someone who did, so, in
1963, Varni sent him to Kenneth Hazlett, an athletic young man who
was the foreman of the university's computer room. Hazlett had had
only two years of higher education, at Oakland City College, but
he had been introduced to tabulating machines during a two-year
spell in the Navy, and after taking an I.B.M. course in programming
he had begun teaching the skill to some of his staff at Berkeley.
"Joe Harris walked into my office with a handful
of these Port-a-Punch cards and wanted to know if they'd go through
a computer," Hazlett recalled. "I walked him outside my office to
a small I.B.M. computer, and from the console I keyed in about a
three instruction loop that would simply flush these cards through
the card reader. And they went sailing through. Joe Harris just
lit up!" Harris realized that he could use the cards themselves
as ballots. He showed Hazlett a mockup of the prototype, and, Hazlett
said, "I agreed to do him a real program." To produce and sell his
invention, Harris then formed Harris Votomatic, Inc., with a quarter
of a million dollars he raised from about two dozen of his colleagues
at the university, including Hazlett, and from Varni. Having retired
from teaching, he then began driving around the West trying to sell
Devising the early programs for what became the
C.E.S. systems, Hazlett gave next to no attention to security against
the kinds of fraud that could be concealed in the computerized system
itself. "There are two problems," he told me last spring in his
sunlit apartment in Corvallis, Oregon. "One is getting the system
to work the way you want it to, and the other problem is avoiding
fraud. We concentrated mainly on the first. Then, beyond that, we
worked with county and state governments, cooperated in developing
procedures for logic-and-accuracy-testing programs -which is running
ballot cards having known votes through and verifying the totals
that are produced, and even the counting by hand or machine of selected
precincts post-election to look for fraud or error. And that's about
all we can do."
Does Hazlett have confidence now in the security of computerized
elections against fraud?
"Not a hundred per cent," he said. However, he
added, he knew of no elections that had been stolen by computer.
Is a logic-and-accuracy test actually a test
of a system's accuracy?
"Obviously it isn't as far as you could go in testing the program,"
Hazlett said. "It's a very simple test. If
a programmer had the necessary programming tools, he or she could
get around that kind of test-of course. Knowing that the deck is
fifty-five cards, you could trigger some function to come into service
after fifty-five cards. Use your imagination-there are any number
of things you could do. It's not an easy problem."
According to Donald G. Baumer,
an engineer who worked with Hazlett, both of them realized that
the Votomatic counting system could be manipulated-for instance,
through the toggle switches that were on the front of a Data General
Nova computer -but it was assumed that nobody would do this, because
anybody who tried it could be seen. In the workshop at his
small election-equipment company, near San Francisco, Baumer explained,
"The concept was to devise a program that no one could ever get
to - you would have to be a knowledgeable person, you would have
to have the source code, and you would be very visible, standing
in front of a computer throwing switches."
As Harris got older, he realized that he could
not wheel around the country selling Votomatics forever. Managers
who were looking for new products had taken over Varni's unit at
I.B.M., and in 1965-Varni having disclosed his investment-I.B.M.
bought the assets and patents of the Harris Votomatic and became
for four years the nation's principal computerized-election-equipment
company. Harris served I.B.M. as a paid consultant throughout the
"Glitches"-the term that company people seem to
prefer for errors and accidents in computer elections-began to emerge
in those earliest years. For example, in May, 1968, in Klamath County,
Oregon, candidates' positions on the ballots were rotated in the
precincts to avoid giving any candidate the unfair advantage of
the top position everywhere, but the ballots got mixed up, and voters
in more than a fourth of the precincts punched out rectangles for
candidates they did not mean to vote for. Harris said later that
as the new system became controversial, I.B.M. responded in some
communities "by instructing its staff to describe the machine as
the Harris Votomatic," not I.B.M.'s.
In Los Angeles County in the June, 1968, Presidential
primary, deputy sheriffs were to carry voted punch cards from the
precincts to two regional counting centers-one on Third Street,
and the other at the I.B.M. Service Bureau Corporation, on Wilshire
Boulevard, next door to the Ambassador Hotel. However, after Senator
Robert F. Kennedy was shot that night at the Ambassador, police
cordoned off a four-block area around the scene, and the tapes containing
the totals from the Third Street center could not be brought into
the I.B.M. building. The counting was not completed until nine o'clock
the next morning. Reporters were irritated by the delay, and officials
at I.B.M. began to wonder seriously about the risks of the election
business, which, comparatively speaking, was providing only a small
That November, in Missoula County, Montana, in
the national contest between Hubert Humphrey and Richard Nixon,
another difficulty arose. Joseph H. Chowning, who was an I.B.M.
salesman then, told me not long ago, "Through a programming error
in a few precincts, ballots cast for Nixon were counted for Humphrey
or vice versa." In traditional Republican strongholds, Nixon was
defeated, while Democratic redoubts went for him. In a precinct
where both paper and punchcard ballots were used, Nixon swept the
paper ballots, but the computer voted for Humphrey by a landslide.
The error was caught immediately, Chowning said, but he and an I.B.M.
publicrelations man had to fly to Missoula to dispel the unease.
One other event, a singular one, came to Chowning's
attention about this time. "Just before or after the 1968 election,
there was an article or editorial in a small suburban Chicago newspaper
that came out and said that the reason I.B.M. was in the business
was to make Thomas Watson President of the United States," he recalled,
referring to the chairman of I.B.M. "I'm guessing, but I'm sure
it went right straight to Mr. Watson's desk." Ken Hazlett, too,
has a vague memory of this. "I wondered at the time if T. J. Watson
was interested in running for President," he told me.
Chowning went on, "Here I.B.M. had a product that
guaranteed two or three per cent of its gross income and eighty
to ninety per cent of its publicity, not all of it favorable." I.B.M.
got out of the vote-counting business. By 1969, it had licensed
five voting equipment companies to sell the Votomatic: two in Illinois,
one in New York, one in Tulsa, and C.E.S., which was founded by
Varni and three other I.B.M. men-Chowning, Jack Gerbel, and Ken
Hazlett (whom I.B.M. had hired to write programs for the Votomatic)-and
which therefore had the great advantage of its executives' association
with I.B.M.'s reputation.
Varni and his team at C.E.S. had a good run. By
1976, nearly seventeen million voters-more than a fifth of all those
voting for President that year-entrusted their election decisions
to C.E.S. counting systems.
The C.E.S. Votomatic punch-card system "has probably
had more effect on the country than almost any other product," Varni
said to me. Although today it is generally regarded as an outmoded
technology, it is by far the most widely used method of counting
votes by computer. The Votomatic is based on the assignment of a
tiny, numbered pre-perforated rectangle on a standard eighty-column,
twelve-row I.B.M. punch card to each candidate and the assignment
of other rectangles to the "yes" and "no" positions on each question
to be voted on. This punch card, covered with numbers but displaying
no names of candidates and none of the propositions to be voted
on, is the ballot. The vote recorder, which is the Votomatic,
is a spined booklet listing the choices of the day in writing and
mounted over a plastic mask that is designed to prevent voters from
punching out any holes but the ones they are supposed to be able
to punch. The voter slides the punch card underneath the booklet
and then fits two holes near the top of the card onto two posts
that are intended to keep the card properly aligned under the booklet.
Alongside the choices printed on each page, arrows point to holes
that match numbered rectangles on the underlying card. The voter
turns the pages and, using a simple stylus attached to the device
by a chain, punches out the rectangles that, as holes in the punch
card, express his or her choices.
After the polls close, stacks of the voted punch
cards are fed into card readers, in each precinct or in one central
counting place, depending on the preference of the officials of
the jurisdiction. A blower in each reader creates an air-stream
and fluffs up some of the cards at the bottom of the stack; a pump
creates a vacuum; and a spinning cylinder attached to the pump seizes
a ballot and flings it past a light whose beam flicks through each
punched-out hole, the cards whizzing through the reader at a rate
of up to a thousand a minute. If the spinning cylinder doesn't grab
two ballots at a time, if the minute punched-out rectangles of cardboard
have separated properly from the cards, and if the computer underneath
and connected to the card reader has been programmed correctly,
the computer then quickly and accurately tabulates the votes; that
is, it counts according to its location each pinpoint of light that
twinkles through a card for a millisecond.
The punched-out scraps, which have come to be called
"chad," are supposed to be forced between two vertical rubber strips
underneath the ballot and into a chad box. Sometimes, however, a
chad does not break completely free from the card and becomes a
"hanging chad," and sometimes voting-hole rectangles are merely
indented by the voter's stylus. "Hanging chad has been with us since
the invention of the Votomatic," Hazlett told me. C. A. Rundell,
of Cronus, informed me during an interview in his office in Dallas
last fall that because of the chad problem, and also because of
wear and tear on the ballots, vote totals may not change the first
time ballots are run through the card reader, and probably won't
the second time, but the third or fourth time they may change, "and
then you've lost your audit trail." The inexact science of divining
what the voter intended in the case of a mere indentation or whether
the card reader counted a hole that was partly or wholly blocked
by a hanging chad has been called "chadology."
Presumably, most of the elections counted by the
C.E.S. systems went smoothly ("People don't want to read about a
good election," Jack Gerbel told me in September), but the company
did have problems. In the 1970 primary in Los Angeles, voters in
some precincts voted for the wrong candidates because of incorrect
rotations; in other precincts ballot pages were missing. A computer
program did not record totals on a hundred of its counters. Ballot
cards jammed in the card readers and had to be duplicated by election
workers-clerks were seen poking holes in punch cards with pencils.
The central computer stopped or was stopped six times during the
counting; and it was discovered only after the counting that more
than five hundred precincts had been overlooked.
In 1970, the election commissioners in St. Louis,
who were considering buying the Votomatic system, asked the accounting
firm Price Waterhouse to evaluate it, with devastating results.
Security controls on the Votomatic would be "more easily subject
to abuse" than those on the mechanical machines in place, the firm
said. Candidates' names could be misaligned
with the rectangles on the ballot "by manipulation of the ballot
book pages' printing or positioning, by manipulating the positioning
of the punched card used to record the vote, or by manipulation
of the program used to tabulate the vote," the report
continued. "It is possible to write a program
in such a way that no test can be made to assure that the program
works the way it is supposed to work.... It is possible to set card
readers to misread the information punched into the cards. It is
possible to have instructions in computer memory to call in special
procedures from core, tape, or disk files to create results other
than those anticipated. . . . There is no practical way to assure
accuracy of the proposed computer tabulation short of complete duplicate
processing on third party computers with reproduced ballot card
decks and third party control programs."
Gerbel, who was taking over the C.E.S. sales effort
in major jurisdictions, responded with a long recitation of the
customary tests and safeguards, and also emphasized the system's
acceptance in fifteen states, discounted "information supplied by
competitors," and concluded, "For six years, the personnel of C.E.S.
have answered the comments made in this report by conducting successful
IN 1977, C.E.S.
was bought out by Hale Brothers Associates, a San Francisco investment
company controlled by Prentis Cobb Hale, Jr.When his
family acquired C.E.S., through a "friendly cash offer," for twelve
million dollars, Prentis Hale, an influential
Republican who was given to partridge-hunting with General Franco
in Spain, was best known as the Hale in Carter Hawley
Hale (C.H.H.) -the nation's seventh-ranking chain of department
stores and the largest chain in the West. The year Hale bought the
election company, C.H.H. earned fifty million dollars on sales of
a billion and a half dollars.
A couple of years later, C.E.S. survived an investigation
by the antitrust division of the justice Department. "We became
the target of a criminal grand jury," David L. Dunbar, the company's
president at that time, told me recently. The investigation lasted
more than a year, and the company turned over a whole file cabinet
of records to the justice Department. The
investigation was dropped very early in 1981-in January or February,
Dunbar recalled, adding, "I used to kid people we had to get Ronald
Reagan elected to get this thing killed."
As the eighties opened, C.E.S. was the unchallenged leader in the
business of computerized vote-counting equipment. In 1980, C.E.S.
systems were in place where about thirty-five million Americans
were registered to vote, and they counted about three out of ten
of the votes that were cast in the United States. Two years later,
C.E.S. equipment tallied thirty-six per cent of the votes in the
country. As of November 6, 1984, nine out of twenty votes,
44.2 per cent-were counted on C.E.S. equipment in a thousand
and nineteen jurisdictions in forty states. To
put this a different way, the electronic technology made and marketed
by one small company housed in an industrial building near San Francisco
Bay counted the votes that were cast in more than sixty-four thousand
precincts where almost forty-seven million Americans were registered
The period 1977 through 1986, when
C.E.S. for the most part dominated the computerized-election business,
was a time of technical mishaps and rising suspicion. A precursor
of the serious breakdowns that lay ahead had occurred in a legislative
race in Los Angeles in 1976. The outcome was reversed twice-once
by a machine recount, the second time by holding every one of the
hundred thousand ballots up to a light and counting the holes one
by one. "Hanging chad" and "bulging chad," as the indented tabs
were sometimes called, were blamed for shifts of tens of votes in
In 1978, a candidate for comptroller of
the State of Illinois refused to believe he had lost Madison County
by a large margin, and it turned out, according to Michael Hamblett,
a member of the Chicago Board of Elections, that the totals had
"flipped-here was a computer flip-flop."
That same year, in a statewide recount for secretary
of state of Ohio (which Mark Braden, the present general counsel
of the Republican National Committee, helped to conduct), only sixteen
votes changed out of about three million. But overvoting on punch-card
ballots was beginning to trouble Ohioans. Anthony Celebrezze, Ohio's
secretary of state, estimating that about fifty-five thousand voters
had had their votes invalidated in this way, asked, "Are they being
partially disenfranchised by some peculiarity of the equipment itself"
In El Paso, Texas, the winner of a 1978
school-board race, Marvin Gamza, was deprived of his victory
when the computer failed to count votes cast for him in three precincts,
because ballot layouts from an earlier election had been used in
them. Suspicions were voiced that the mistake had been deliberately
left uncorrected, and the federal judge who heard the case,
John H. Wood, was angered when he learned, from the television news
one night, that some of the relevant ballots had been burned. He
concluded that "a willful effort" had been involved in the error,
rejected the claim of the putative winner, and installed Gamza on
the school board.But Judge Wood was overruled on appeal,
because Gamza had filed his protest too late. "The winner lost,"
said Malcolm McGregor, Gamza's lawyer, but McGregor doubted whether
the mixing up of the layouts was premeditated, because, he said,
"a baboon would not have tried to steal the election that way."
In 1980, computerized vote-counting faltered seriously
in a number of jurisdictions across the country. A study by the
city clerk of Detroit concluded that in a primary conducted on the
C.E.S. punch-card system, which the city had just installed, votes
on one out of every nine ballots cast had been invalidated-fifteen
thousand in all because people had tried to vote in two parties'
In that same year, when a mark-sense system sold
by Martel Systems, of Costa Mesa, California, was used for the first
time in Orange County, California, a Republican stronghold, there
was a four-day delay in the count. On Primary Night, more than fifty
precinct-level memory cartridges had broken down, and-because of
programming errors, it was explained-the computers had given about
fifteen thousand Democratic-primary votes meant for delegates for
Jimmy Carter or Edward Kennedy to delegates for Lyndon LaRouche
and Jerry Brown.
Montana law permits voters to demand paper ballots,
and in Missoula (where votes for Humphrey and Nixon had been interchanged
in 1968) as many as thirty per cent of the voters chose to vote
this old-fashioned way. Still in this same year, 1980, card readers
broke down in jurisdictions in Michigan, Arkansas, Indiana, and
Utah. In Salt Lake City, a central card reader started "putting
out jumbled numbers on about three out of every hundred ballot choices,"
according to a news report. In a township in Ohio, two tax proposals
were switched; the voters would have taxed themselves five times
as much as they wanted to if the error hadn't been discovered after
the voting. In Custer County, Nebraska, the county clerk said
that a count on a C.E.S. system concerning a school-closing issue
showed more people voting than were registered. The computer
had also refused to read some ballots and had read only parts of
others. In Bradenton, on the Florida Gulf Coast, a seventh of the
county's precincts had to be counted twice, because "soggy, warped,
and mangled ballots" occasionally jammed the computers. Directly
across the panhandle, at Fort Pierce, on the Atlantic, new computerized
machines counted Democratic ballots well enough but refused to accept
Republican ones. "It was awfully strange," the supervisor of elections,
James Brooks, was quoted as saying. "Those damn machines must have
been built by the Democrats."
In San Antonio, Texas, in perhaps the most consequential
breakdown in 1980, it was discovered that the C.E.S. program
that counted votes in the Presidential election in Bexar County
could not tally more than nine thousand votes for any race, so the
computers had not counted many of the votes cast for Ronald Reagan
and two other Republican candidates. The official post-election
canvass found that sixteen-hundredths of a per cent fewer total
votes were cast than had been reported on Election Night, whereupon
the San Antonio Express noted, "As San Antonio moves into
the computer age, the slogan of the universal suffrage movement
becomes, `One man, 0.9984 vote.' " The recount dragged on
for several weeks, with local politicians pointing fingers at each
other. Mike Greenberg, a columnist for the Express, learned
that election officials had taken unmarked ballots home overnight.
"Even already marked ballots could be tampered with," he went on
to say, continuing, "Anybody with a straightened-out paper clip
could punch out a few more holes to either spoil a ballot with the
`wrong' votes or cast `right' votes in races ignored by the legitimate
voter." In due course, Bexar County returned to lever machines.
A candidate for the school board in Carroll County, Maryland, in
1984, T. Edward Lippy, finished third, with about six thousand
votes. When, in obedience to state law, the voted C.E.S.-system
ballots were taken to an adjoining county to be recounted on a different
computer system, about twelve thousand five hundred uncounted votes
were found, and it was learned that in fact about nineteen thousand
citizens had voted for Lippy. He was proclaimed the winner.
The error was explained as a slip-up by a local data-processing
official. ("It was my mistake," he said.) He had inadvertently replaced
the correct C.E.S. provided program with a test program that would
not count two votes if they were punched in one column on the ballot,
and most of the voters who favored Lippy had also voted on a home-rule
proposition in the same column with the numbered rectangle assigned
to votes for Lippy. The wrong program had also cost President Reagan
more than two thousand votes in the first count. A standard pre-election
test had not caught the official's mistake; in a state without the
requirement to double-check the count, it could have been missed.
In 1985, in Moline, Illinois, a candidate
for alderman served for three months before a recount removed him
from office. This mistake was laid to a slipping timing belt that
had caused the card reader to fail to count a number of straight-party
votes for the real winner. The apparently defeated candidate, it
turned out, had actually won handily.
IN the fall of 1980, Michael Shamos, a computer
scientist, law student, and businessman who was teaching at Carnegie-Mellon
University, in Pittsburgh, and running a software company, saw an
announcement on a computer bulletin board that the Commonwealth
of Pennsylvania was looking for examiners for computerized-voting
systems. He knew nothing about such systems, but the job sounded
interesting, so he signed up and went to Harrisburg to examine the
C.E.S. Votomatic system. "What I saw that day," he told me not long
ago, "was hairraising and mind-boggling: antique, obsolete, unreliable
technology packed with a systems approach that was even more unreliable."
We were talking in the upstairs study of Shamos's
home in Pittsburgh. On the wall above his desk was a large Princeton
University pennant. He has degrees in physics from Princeton and
Vassar; an M.S. from American University in the technology of management;
three degrees in computer science, including a doctorate, from Yale;
and a law degree from Duquesne. Shamos continued, with feeling,
concerning the Votomatic system, "Counting paper ballots is no picnic.
I really thought hard about this. Am I being picky? I came to the
conclusion that it's far worse than a paper ballot. After all, what
is the rush? I for the life of me couldn't figure out why anybody
would use this."
That November, Shamos presented to Pennsylvania's
Bureau of Elections his evaluation of the C.E.S. election system.
Punch-card technology was obsolete, his report stated. The C.E.S.
system had not been modernized and was "a security nightmare, open
to tampering in a multitude of ways," Shamos continued. "It is apparent
that security was not taken seriously as an issue during the design
of the Votomatic." The report went on to note that the ballot pages
in the Votomatic booklet could easily be shuffled or replaced; blank
punch-card ballots were easy to obtain; and the plastic seals on
the boxes used to transport voted ballots for central counting were
easily duplicated. Moreover, the system could not be verified
without examination of its source code, yet C.E.S. had refused to
produce that code; no effort had been made to restrict access to
the control panels or the toggle switches on the computer, with
which "any person can enter arbitrary numbers into the machine's
counters;" and the counting program, loaded through a deck of punched
cards, could be altered to change the counting "by inserting or
deleting a single one of the cards or by transposing two of them."
Shamos now warned, "The following scenario
is thus fully possible. A would-be election fixer enters a voting
booth with a card concealed on his person that, when read by the
tabulating computer, will reset its counters to values desired by
the fixer. On leaving the booth, he presents this card, conveniently
wrapped in its secrecy envelope, to an election official who, not
being permitted to examine it, drops the `ballot' into a box. After
the election, the card makes its way to the central counting facility
where it is read by the computer. Instead of being counted as a
vote or rejected by the system, the effect of this card is to change
the current vote total for any candidate desired."
In a carefully worded paragraph headed "Concentration
of Control at C.E.S.," Shamos noted, "All
software used in the Votomatic machines is obtained in the form
of secret card decks supplied by C.E.S. Without casting doubt on
the integrity of C.E.S. in any way, nonetheless, the possibility
exists that an unauthorized person may gain access to the central
point from which these programs are distributed and alter them.
The implications are frightening when it is remembered that one-quarter
of all votes cast in the U.S. are counted by these programs."
Throughout the evaluation, Shamos wrote, C.E.S.
"took the attitude that the Votomatic system has been in use for
seventeen years, has been evaluated by more than thirty states,
and has never been denied certification. In response to virtually
every question regarding a deficiency, the vender responded by stating
that the problem had been considered by a number of other jurisdictions
and was found not to be serious.... The Votomatic system must be
Pennsylvania assigns three examiners to inspect
each voting system submitted for certification, but the decision
about it is made not by them but by the secretary of the Commonwealth.
One of the other examiners found the system acceptable. The third,
C. Kamila Robertson, of the computer-science faculty at Carnegie-Mellon
(who said that the voting booklet had come apart in her hands, and
that "it would be easy to sabotage the computer in this system ...
the switches are there for the switching"), agreed with Shamos.
The secretary of the Commonwealth certified the system, but Shamos's
report soon became one of the basic documents in the controversy
over computerized vote-tallying.
THE precinct-level corruption that Joe Harris had
witnessed in Chicago in the twenties was visible again in the 1982
election there, but now instead of repeat voters the precinct
captains had repeat votes, as counted on the C.E.S. system. According
to the report of a grand jury that investigated the 1982 election,
and whose indictments led to fifty-eight convictions, ward committeemen
appointed city employees as precinct captains, and these factotums
either produced for the political machine on Election Day or lost
favor with their patrons. The grand jurors reported, "One
precinct captain and his son disregarded the actual ballots cast
by voters and instead held their own fraudulent election after the
polls closed by running two ballots through the voting machine.
One ballot was a straight Democratic `punch 10.' That ballot was
counted by the machine a total of one hundred and ninety-eight times.
To make the results less suspect, they also counted a ballot containing
some Republican votes a total of six times. Consequently, all but
two of the voters in that precinct were disenfranchised."
The grand jurors said that in many Chicago precincts
in 1982 faked punch-card votes were cast in the names of
transients, the ill, the incapacitated, and people who had moved
away, had died, or had not voted. Runners worked the boarding houses
and hotels to find out who was not coming to the polls. "The ballots
either were punched on the voting machines by people posing as the
voter, or were punched with ball-point pens or other similar objects
in a private place outside the polling area," according to the grand
jury's report. In one named precinct in the Thirty-ninth Ward, the
captain gave lists of non-voters to one of the election judges,
and she slipped them into her shoe. During the day, she would draw
out a list when no one was looking and forge names from it on blank
ballot applications. "The precinct captain and others apparently
retreated to the privacy of the men's washroom to punch some of
the ballots," the grand jurors said.
THE legal conflict that perhaps best embodies the
doubts about computerized democracy, and demonstrates-whether the
plaintiffs or the defendants were right in this particular case-many
of the difficulties of proving charges of stealing elections by
computer, started in Charleston, West Virginia, in 1980 and
ended, for all practical purposes except for the plaintiffs' liabilities,
in a federal appeals court in Richmond, Virginia, in 1986. In
1971, Jack Gerbel, of C.E.S., and an area C.E.S. representative
had presented the Votomatic for approval in West Virginia, but the
state's two examiners rejected it. They cited its permitting of
overvoting, and they stated, "The computer program ... can possibly
be modified by an experienced data-processing person, causing the
computer to miscount votes cast for a particular race." However,
the West Virginia secretary of state, Jay Rockefeller (who is
now United States senator from West Virginia), seeing, as he wrote
at the time, that the report of the examiners was negative, designated
two new examiners, and they approved the system.
At about 7 P.M. on November 4, 1980, as Ronald
Reagan was being elected President, Walter J. Price III, a plump-cheeked,
energetic young man in a blue blazer and khakis and his "Election
Day" tie-blue with diagonal gold and red stripes-drove down to the
voter registrar's office in Charleston. A freshman Republican legislator
in a county that Daniel Boone had once represented in the Virginia
Assembly, Price was going downtown to see himself reelected, as
he thought, and to watch the operation of the new system the county
had bought the year before from C.E.S. He was not worried about
vote fraud, he told me later, because the first clerk of Kanawha
County the Republicans had had since 1932, Margaret (Peggy) Miller,
would be running the count.
Over the vehement objections of the voter registrar,
Carolyn Critchfield, Price threaded his way among desks and people
toward what the election workers called the computer cage. This
was a small room with windows on all sides that began about four
and a half feet above the floor and a Dutch door that had a window
in its top half. The two vote-counting computers of the BT-76 (Ballot
Tab) system in Charleston, one of them designated the "master" and
one the "slave," had been set up on the floor inside, with punchcard
readers on top of them and printers beside them. On the computers,
down near the floor, were sets of toggle switches. Price has testified
under oath, and repeated in greater detail during lengthy interviews
with me, that, as he walked around the outside of this room looking
in during the next hour and a half, he saw four kinds of actions,
which, four and a half years later, dominated the only known court
trial so far of charges that an election was stolen by computer.
The people who Price said took these actions have all vigorously
denied doing so, also under oath.
Traditionally on Election Night in Kanawha County,
the vote totals were announced and posted in the precincts. This
year, none were. Instead, the uncounted voted punch cards were all
carried from the precincts to the registrar's office and run through
one central system, which Walter Price was looking at. Only these
cumulative centralized counts, which included no record of precinct-by-precinct
totals, were coming out of the whining, clacking printers; then
they were ripped loose and fed to the local reporters and to the
citizens who had gathered on the other side of the chest-high reception
Price said that at least four times while he was
looking into the computer room that night he saw Peggy Miller, the
county clerk, drop down into what he called a coal miner's squat-"not
on her knees but bent down with her knees coming up toward her chest"-in
front of the sixteen toggle switches on the master computer, consult
notes she had on a pad or clipboard, put the notes down, turn a
key, flip some of the switches, and turn the key again. Such an
action was not called for in the counting of the votes. After Peggy
Miller finished flipping the switches, Price said, she reclaimed
her notes and stood up. On more than one of these occasions, she
walked over to the nearby "dasher," a slow printer, "and she would
type some things and then the printer would run," he said.
The incumbent congressman for that district, running
again, was a Democrat, John Hutchinson. He had been elected the
mayor of Charleston three times in the seventies, and in 1976, during
his service at City Hall, he had run for governor, but had lost.
Although he and Jay Rockefeller, who in 1980 was the Democratic
governor, were not friendly, Hutchinson was regarded by Walter Price
as one of the five most influential Democrats in the state. Mick
Staten, Hutchinson's Republican opponent, was a close friend of
Peggy Miller's husband, Steven, a lawyer, who was the general counsel
for the Republican executive committee of that congressional district,
and Staton's largest campaign contributor. Hutchinson had trounced
Staton in a special election the preceding June, and two polls conducted
by the Charleston Gazette had predicted that Hutchinson would
win again, in the counting that Price was watching, by a spread
of between fourteen and sixteen percentage points; that is, by around
twenty-five thousand of the votes that were being counted. Hutchinson's
wife, Berry, said that a poll by the Democratic National Committee,
too, had shown that her husband would win by a wide margin. Staton
himself, however, had predicted that he would win, by five points.
Price said that during the counting his fellow-Republican
Steve Miller entered the computer cage, drew out of the inside pocket
of his suit coat a pack of cards between a quarter of an inch and
an inch thick and the same size as the ballot and control punch
cards, patted the cards to even them up, and handed them to his
wife. According to Price, they were talking, but, being behind the
glass, he could not hear what they said. Price testified that Peggy
Miller ran the cards through the card reader, retrieved them, and
gave them back to her husband, and that he returned them to his
breast pocket and left the room.
Seated at a table lodged between elements of the
C.E.S. system was a man Price had never seen before. Clearly, the
person he was referring to was Carl Clough, the Northeast sales
manager of C.E.S., who had been with the company for ten years.
Price said he saw this man busily using a telephone and what seemed
to be a calculator. Open in front of him on the table was a large
case resembling a briefcase. Three or four times, Price said, the
man grasped the phone as one might the handle of a suitcase, and,
he told me, he "places it, he very carefully places it"
in the case; he "pushed it down ... it was just a very deliberate
pushing in" of the phone. After a time, he said, the man put both
hands to the case, seemed to hold it down with one hand "like he
was steadying, like there was some resistance to," the phone's "coming
out," and, with the other, pulled the phone out "with some force."
This resembles a description of a man using a modem, a device that
permits computers separated by hundreds or thousands of miles to
communicate with each other over telephone lines.
The operator of the master computer that night
was Darlene Dotson; the secondary, slave computer was the responsibility
of Vicky Lynn Young, just two years out of high school. Vicky Young
needed to keep her job, because she was taking care of some of her
close relatives. Nevertheless, later, on the witness stand, she
swore that on one occasion during the counting in the cage Clough
"told me to go over and stand beside Darlene and help her with her
computer so that nobody could see."
Had this happened? Clough was asked during the
trial. "Absolutely not," he replied. Furthermore, he said, he had
had a briefcase in the computer cage, but there had been neither
a modem nor any other electronic equipment in it. He thought that
he had used a phone in the cage, but that it could have been moored
in an adjacent room. Young testified that Clough had tools but had
not used a modem; he denied that he had any tools. Dotson averred
twice before the trial that there had been a phone in the room and
that Clough had used it "more than once;" at the trial she said
there had been a phone jack in the room, but no phone.
Peggy Miller said on the stand that she had not gone into
the computer cage at all on Election Night, thereby denying Price's
testimony. (Mrs. Miller, who has resumed her former career as a
schoolteacher, and is a candidate for the state legislature on November
8th, later said to me of Price, "He lied in court," and she also
said, "He'll testify against his mother if it'll get him something.")
Steve Miller, asked by the lead attorney for the plaintiffs, John
Mitchell, "Did you enter the computer room and take several computer-sized
cards out of your pocket and lay them down?" answered, "Absolutely,
positively no." Clough said the Millers had not been in there while
he was, although he had "stepped out a few times." A county commissioner
said that he had seen Peggy Miller in the room. Dotson said that
the Millers were not there and that Peggy Miller "may have come
in, but not all the time." Young "didn't remember" Peggy Miller
there, and said that she did not see Steve Miller come in "that
In a document having to do with an appeal, the
defendants described Price's testimony as uncorroborated and "soundly
contradicted by every other witness called by plaintiffs who was
in a position to observe the occurrences in the computer room."
They characterized Young's testimony as a denial that Peggy Miller
had manipulated the toggle switches; they stressed that Price had
not known the identity of the man he had seen with the briefcase.
On the night in question, Price, following the
returns, perceived that he was losing his position in the House
of Delegates, and after saying so to a friend of his he exclaimed
loudly, pointing to the computer cage, "The only election I lost
was in that room!" Hutchinson, too, lost that night, and by nearly
ten thousand votes-the five percentage points by which his opponent,
Mick Staton, earlier that fall had predicted his own victory.
Leonard Underwood, a Baptist minister, who had
been defeated for the legislature by seven votes, challenged the
Charleston results in a lawsuit, but Peggy Miller said that sixty-two
days after the election-just two beyond the earliest legal moment
in the absence of a contested election-she had had the punch-card
ballots destroyed, not realizing that Underwood's challenge was
still pending. "Anytime an election is completed ... those materials
are cleaned out," she said. "Otherwise we would have a continuous
buildup of materials."
T. David Higgins, a Union Carbide computer specialist
who was also the chairman of the Kanawha County Republican Party,
testified during the trial that in Charleston in the summer of 1981,
at a political affair for Representative Staton, he had spoken at
length with Steve Miller:
He was very unhappy with the
fact that I was working with the joint House-Senate subcommittee
here at the Capitol which was looking into the whole question
of electronic voting in the state of West Virginia. And he also
said something to the effect of how it worked out that my working
with them, collaborating with them, somehow in his mind cast aspersions
of.... He suggested that I thought there was something irregular
in the election of November, 1980, here specifically in Kanawha
I said to him at that point that
I did not think they had done anything wrong in the election of
1980. I said to him, "I do not think that you understand enough
about this computer to rig it to fix an election." And Steve looked
me in the eye, grinned like
a shark ... and said to me, "You underrated us."
(In a recent interview, Steve Miller denied that
he had said "You underrated us" to Higgins at the Staton affair.
"He told me about reports he had heard from Democrats that `you
guys had stolen the election,' and that he had told them we weren't
smart enough to do that," Miller said. "And he's right, I grinned
like a shark. In fact, I laughed out loud. I told him, `Thank God,
neither are you, David,' and turned on my heel and walked off."
Miller went on to describe Higgins as "a conceited, arrogant fop"
and "a shallow idiot." On the subject of Walter Price's testimony,
Miller said, "He's a liar. I've never been in that computer room
in my life." As for Price himself, he said, "If I had a choice between
sitting down with him and a polecat, I'd pick the polecat.")
C.E.S. officials in Berkeley, upon learning of
the rising public alarm in Charleston, sent out one of their programming
consultants, C. Stephen Carr, who had probably written or revised
as many of the codes for votecounting machines as anyone else in
America. Testifying at hearings on electronic voting that had been
called by the West Virginia secretary of state, in Charleston, Carr
declared, "While any computer system can be penetrated, the time
and effort to penetrate this one is so extreme as to render it effectively
Representative Staton was defeated for reelection
in 1982. The West Virginia legislature passed a law that year requiring
that after each election "at least five per cent of the precincts
shall be chosen at random and the ballot cards cast therein counted
manually." A special grand jury that was convened to investigate
the November, 1980, election indicted Peggy Miller on six felony
and nine misdemeanor charges of election-law violations, none of
them directly related to the computers, and she was tried and acquitted
on all counts.
THREE of the Democrats who had lost in 1980-Hutchinson,
Underwood, and Bill Reese, a candidate for county commissioner-continued
to be troubled by the outcome even after Miller's acquittal. Underwood
wanted the three of them to sue for damages.
John Hutchinson told him,
"Why, you're crazy as a bedbug, they beat me by ten thousand votes."
Underwood replied, "If you're
gonna steal it, you can put in ten thousand as easily as ten."
Dozens of times, driving past the Hutchinsons'
home, which is near his own in Charleston, Walter Price recalled,
he thought that he should go in and tell Hutchinson what he had
seen in the computer cage. "It occurred to me that that poor man
ought to know what really screwed him out of Congress," Price said
to me. "Why I didn't do it I don't know."
In mid-1982, though, he said, he happened to take
a seat in front of the Hutchinsons at a public meeting in the state
capitol, and Berry Hutchinson, a shrewd and ebullient woman, who
is a member of an old-money Charleston family, leaned forward and
asked him, "Were you by any chance present when the ballots were
being processed in 1980?"
"Well, yes, I was," he replied.
She told him she and her husband would buy him
lunch in the basement cafeteria if he would tell them what he had
"For about thirty-five seconds," Price told me,
he flinched mentally at "having truck with Democrats" and at having
everybody see him walk through the capitol with John Hutchinson,
but then-"It was a flash of lightning"-this response was erased
by the thought Well, hell, you've got to do what's right. Price
thereupon said he would go. Over lunch, he said, he described to
the Hutchinsons what he had seen, and during a visit to the computer
cage after lunch he showed Berry Hutchinson the toggle switches
on the front panel. Outside the registrar's office, she said later,
she asked him whether he would testify if they filed a lawsuit,
and he said yes.
Early the next year, John Hutchinson, Underwood,
and Reese, their evidence dramatically fortified by Walter Price,
sued the Millers, the registrar of voters, the county commissioners,
C.E.S. and four of its employees, and others for about nine million
dollars in damages, alleging (in their third amended complaint)
that various of the defendants had "tampered, directly and/or indirectly,
with the computer programming of the election computer" and "rigged
the counting computers by the manipulation of control toggle switches
and the use of predetermined material or both in such a way that
the computer did not reflect an actual count of ballots cast." The
plaintiffs contended that by these and other means they had been
deprived of "their constitutional right to vote or receive votes
[and] their right to hold public office," and of income, reputation,
time, and money.
Needing a computer expert, the plaintiffs turned
to Wayne G. Nunn, a slender, soft-spoken man of thirty-six who was
a project scientist for Union Carbide, one of the major chemical
companies in West Virginia's Chemical Valley. Nunn had supervised
the design and installation of computer networks, some costing several
million dollars, for the firm's laboratories and pilot plants. He
had shared an office there for three years with David Higgins, who
was the chief of Union Carbide's computerized technology-intelligence-information
network. Nunn also ran a small custom-software venture that wrote
programs, did consulting, and sold operating systems. He had programmed
computers in many different computer languages and in the field
of artificial intelligence.
Having no confessions from any of the defendants,
John Mitchell determined to rely on circumstantial evidence in trying
to prove a conspiracy. Three weeks before the 1984 Presidential
election, Nunn conducted a nine hour examination of the C.E.S. system,
with Carr, who had programmed it, Kemp, the C.E.S. president, and
a dozen or so other people watching. Because of a clerical slip-up
in the listing of what Nunn wanted to see, C.E.S. was not required
to show him the source code, the diagrams for the circuit boards,
and the operators' manuals. Nevertheless, feeling his way along
in the microcosmic darkness of the program's space, Nunn, with one
punch card, added ten thousand votes to the total of one of the
candidates in a mock race for President.
During a deposition he gave subsequently, under
extensive cross-examination by an attorney for the Millers, Nunn
said that he had perceived seven ways in which the C.E.S. system
in use in Charleston could be caused to miscount the votes: by manipulating
the toggle switches on the face of the Data General Nova computer
to change vote totals and the figure for total votes processed;
by altering the program deck of cards during the counting; by running
"summary cards" through the computer to add votes for candidates;
by changing vote totals using the keyboard at the slow printer that
was part of the system, using another computer located nearby and
connected by a cable, or using a computer thousands of miles away,
by means of modems; or by planting a "Trojan
horse" (hacker jargon for secret, undetectable commands that can
be hidden in a computer program) in the code that controls the vote-counting,
requiring it to switch, say, one out of every four votes from one
candidate to another or give a candidate a false victory by a certain
The plaintiffs were determined to make a second
effort to break the source code, and C.E.S. was determined to prevent
Nunn from studying it. C.E.S. asked Judge Charles H. Haden II, of
the United States District Court, whose wife had been the chairperson
of Reagan's reelection campaign in West Virginia, not to let Nunn
even see the code, because it was "a `trade secret' . . . highly
confidential." Alternatively, the company said, if the Judge forced
them to let Nunn inspect the code Nunn should have to do it at C.E.S.
headquarters in Berkeley and should not be permitted to copy it
or leave with any notes.
Hutchinson and his fellow-plaintiffs assailed the
C.E.S. insistence on secrecy from a broad perspective. "There should
be full disclosure of matters involving public elections," they
contended. "[The] demand for `secrecy' by C.E.S. only insures
that the potential for fraud will be perpetrated. This involves
a matter of strong public policy." (Perhaps the plaintiffs meant
"perpetuated," but their motion said "perpetrated.")
Judge Haden ordered C.E.S. to make the source code available to
Nunn in Charleston, but he ratified the company's practice and requirement
of secrecy, and he decreed, "Dr. Nunn will not reveal any information
to anyone.... No records shall be made of information obtained."
(During the trial, the Judge stated from the bench, "They are entitled
to protection of the secrets.") But the litigants had extracted
their minimum requirement: Nunn had the code, and he examined it
to his satisfaction in a closed office at the local C.E.S. attorneys'
firm for parts of two days.
What he had was a printout of "the assembler third
pass listing" for the BT-76 program-a stack of computer paper still
joined together at the folds which was four or five inches high.
He was allowed to make notes but was not provided with the computer
he needed in order to test the code systematically; all he could
do was look at the highly technical lines of the listing. This was
grueling mental work, and after three or four hours he was very
tired. During the second day, he decided there was nothing more
he could learn from just looking, sealed his notes, gave them to
the C.E.S. lawyers, and left.
Carr and Kemp flew to Charleston to crowd into
the computer cage again and watch Nunn's second examination of the
system. As the day wore on, the number of people watching varied
between ten and twenty-five, and sometimes Nunn could hardly move
around. Mustachioed, skinny, and dapper in a blue suit, he examined
the inside of the computer with a long black flashlight, tested
again how it worked, and printed out results of a mock election.
He announced that with the toggle switches he had been able
to manipulate the figure printed out on a cumulative report for
total ballots counted.
Several hours later, after further examining
the machine, Nunn cast and counted one punch-card ballot, with just
one vote on it, printed a cumulative report that showed one cast
and counted, stopped the computer, used the toggle switches to change
the vote for Position No. 1, re-started the computer, printed out,
and, showing the printout, announced, "The next report is a cumulative
report, again showing one precinct processed, one ballot processed.
But Position No. 1 now has ten thousand and thirteen votes." Then,
again with one ballot, he produced five votes. Then seven. "No punch
cards were necessary," he told me later. "I could have produced
the result of ten thousand or any number we wished without counting
a single ballot."
THE 1985 Charleston trial was conducted between
April 9th and May 2nd in a federal courtroom within a few blocks
of the registrar's office, where the votes had been counted that
November night in 1980.
Midway through the trial, Walter Price gave his
account of what he had seen in the computer cage. After some gambits
that Price parried easily, John F. Wood, Jr., the attorney for the
Millers, pounced on two facts: that in handwritten notes Price had
made on what he had seen he had not mentioned seeing Steve Miller
give his wife the cards, and that in his deposition he had once
called the cards "sheets of paper" and had not said that Steve Miller
had taken them out of his coat pocket. Wood suggested to the jurors
that the witness was making things up, and one of his closing questions
was "That's your story today, isn't it, Mr. Price?"
"I would not characterize my testimony here as
a story," Price retorted. While Nunn was on the stand, the defense
lawyers raised at least a hundred objections, and Judge Haden sustained
about half of them. Mitchell had planned to have Nunn repeat for
the jury, on Charleston's C.E.S. system, his demonstration of how
to steal an election, but the attorney abandoned that because of
positions the Judge was taking on the admissibility of testimony.
"There will be no evidence presented in this case of a Trojan horse,"
Haden informed the jurors. "None will appear."
Nunn was prepared to testify that a "debugger" in the BT-76 program,
while enabling a programmer to make repairs in the program, was
also a Trojan horse; Haden excluded such testimony. Nor would the
Judge let Nunn testify that when he had examined the system he had
found discrepancies in the locations of memory addresses for the
storage of information.
The fact that the C.E.S. system had been officially
approved for use in West Virginia had a perverse effect during Nunn's
testimony. Fifty-nine standards for computerized vote-counting had
been proposed in 1975 by Roy Saltman, a specialist on the security
of computer-tabulated elections, in the then definitive National
Bureau of Standards study on the subject. Nunn had concluded that
the C.E.S. system sold to Kanawha County in 1979 violated thirty-nine
of these standards, but Haden refused to let him say so, on the
ground that the state's approval of the system rendered the Bureau
of Standards report "immaterial."
Nunn managed to tell the jurors (sometimes only
to have Haden order them to disregard the information) that vote
totals could be directly changed by means of the toggle switches
on the computer's front panel without leaving a trace on an audit
trail, and that summary cards, which in the C.E.S. systems are the
same size as the punch-card ballots, could be used to add votes
to candidates' running totals. Nunn also testified that he had concluded
that the program had been changed during the counting.
To alter a candidate's votes with punch cards,
Nunn told the jurors, one does not need to know the candidate's
location in the computer's memory; all one needs is the number of
the candidate's ballot position (a number that anyone voting in
the election can know). With that and one punch card, Nunn testified,
"you can set his vote total in the cumulative counters or in
the precinct counters to zero," and then, with a second card, "you
give him, you know, ten million votes if you want."
When the plaintiffs rested, the defendants asked
Judge Haden to render a directed verdict for their side and send
the jurors home. The legal situation was clear. Before entering
a directed verdict in a conspiracy trial, as defense lawyers observed
in statements to the Judge, he was obliged to give the plaintiffs
"the benefit of every reasonable inference," to read their evidence
"in a light more favorable to them "to give it "favored treatment."
"I find," Judge Haden ruled, "that the only evidence
that the 1980 election was rigged is purely speculative in nature;
it was mere suspicion; and it does not form the basis for the Court
... to infer that a conspiracy may be present.... The plaintiffs
have never proven the existence of a conspiracy or these defendants'
membership in a conspiracy." The ruling continued, "Consequently,
all we have in this case are a series of unrelated acts that have
been proven, most of which have a reasonable and an innocent appearance
as easily as they would have a culpable appearance, none of which
... are attributable to more than one individual or to more than
one entity.... And there are certain things that have been attributable
to the defendants," but "the proof of individual overt acts, however
compelling some few of them may appear to be to plaintiffs' counsel,
does not suffice for the absence of proof of the conspiracy." Haden
entered directed verdicts for the defendants and dismissed the jurors
after their three weeks' service.
A year ago, judge Haden entered a finding that
the plaintiffs would have to pay the legal costs of the defendants,
including C.E.S., which Mitchell estimated would total about six
hundred thousand dollars. Just two of the C.E.S. lawyers had billed
the election equipment company for twenty-seven hundred hours' work
on the case about fifteen working months-and Haden re-billed this
to the plaintiffs, on his judgment that, despite the fact that an
earlier judge had ruled the case not frivolous, it was "meritless."
According to John Mitchell, almost everything that the three plaintiffs
own is tied up by liens pending Haden's entry of his final order
on costs and the resolution of the three defeated candidates' certain
appeal from it. [ is this why no one sues!!!]
"C.E.S. wasted a lot of money defending a case totally without
merit," Stephen Carr, the chief programmer for C.E.S., declared
during an interview I had with him. We spoke in his office at Information
Processing Corporation, his company, which does engineering work
on computer products and consults on computer programming, in Palo
Alto, California. "Three politicians who couldn't believe that the
electorate hadn't voted for them felt that they were surely gypped
by the system. They got a local Ph.D. consultant who worked at Union
Carbide. He was not dumb, but he had essentially, you know, taken
money to be their expert witness, and they tried to show how the
program could be manipulated. The case was so bad that after they
presented their side the judge threw it out of court-the whole thing
What was Carr's view of the ten thousand-odd votes
that Nunn produced with one summary card during the first demonstration?
"With summary cards, you put in totals and multiple counts,"
Carr agreed. "But they also, at least in our design, would leave
a very noticeable mark on the tape. Anyone who was at all knowledgeable
couldn't miss it: a record left that these votes had come in from
a special control card, not from ballots. So I wasn't impressed."
Carr laughed and smiled, then continued, "This
is funny. Nunn also spent a bunch of time trying to show how you
would work from the front panel of the Data General computer called
the Nova. It was front-panel switches that computers of that era
had. And if you know enough and the people will let you, in half
an hour or maybe twenty minutes you might manipulate what's inside
the computer and change things."
Walking me back to a room that was almost filled
with computers, Carr went to a Data General Nova there and gave
me a demonstration of how to raise a storage location for data-sometimes
called a memory address-into the lights and change the figures stored
in it. "But the chance of doing this unnoticed is just nil," he
said. "And doing it in a way that doesn't cause the whole program
to stop is terribly tricky. You can always argue the theory that
there's some superhuman who's smart enough, but it's so hard to
do that that somebody that good probably doesn't use his talent
to mess around with one vote-counting machine. I mean, it's not
citizens in West Virginia; it's, you know, somebody that's the Godfather!
It just doesn't play in my mind that someone that was that up to
speed would care about the race in West Virginia. And, you
know, they had all kinds of theories that we out in California cared
about that race. What we wanted was to run an honest election and
get paid. Not even to run an election-to provide the equipment that
the local people could run an election on. And I will say, as an
outsider, I never saw in my contact with C.E.S. people any evidence
of any kind of impropriety, or even caring. The people I
saw at C.E.S. were interested in making honest money."
Turning to charges about Trojan horses, Carr said,
"There have been some people who say that the way to phony up these
programs is to make them count correctly when the counts are small"-as
in a pre-election test with, say, a hundred ballots-"and then cause
a fudge factor to come in when the counts are large; you then bring
in your bias."
Carr granted that someone
could "put a special thing in the code that when it saw some special
pattern it did some special stuff."
How could that be detected?
"You could certainly find
that by examining the source code," Carr replied. "It would take
I asked Carr about audit trails. He mentioned,
as an example, "a printer that leaves a hard-copy record of what
things happened in time."
Could such a printer be turned off? "You could
imagine someone cutting a wire-you can imagine anything. If the
election officials and the clerks were used to running the computer
and the printer stopped, you'd pick it up right away, because the
printer makes a loud sound. And, of course, typically these Election
Nights there are representatives, or monitors, from all parties
I also asked Carr about the possibility of fixing national elections.
One reason it would be very difficult for a single
programmer at a major election company to fix a national election,
he said, is that although the central source code is general, local
election officials have to prepare instruction cards dealing with
each local election's different candidates and their different positions
on the different local ballots, "so that in one precinct Party One
may be the Democrats, but in another precinct Party Two may be the
Democrats, and the program then follows instructions to put all
the votes for Democrats together. So it would be very tricky to,
in this general program- If you set out to help one party in one
state, you might totally screw yourself in another, it's just that
tricky for the programmer back at C.E.S."
In a close Presidential election that would
be decided in a few large jurisdictions "it wouldn't be impossible,"
I then asked him how, hypothetically, he himself
might go about such an undertaking.
In response, Carr adverted to his basic position:
"I just don't know how you'd do it. I really don't. Because, even
with the computer doing the counting, there are so many people involved.
It would take a major conspiracy. You'd have to have a lot of people-twenty,
thirty, a hundred people-on your side. It wouldn't be one man. It
certainly wouldn't be anyone who did the program." Even if a corrupt
official is running the counting in a big city, "he still has to
depend on a lot of staff," Carr said. "It would take at least one
person from each of the disciplines-programming, the management-to
really get a start on it, and then there'd be tremendous risks you'd
be found out. I don't think it's doable."
WHAT had Wayne Nunn actually seen when he looked
at the C.E.S. source-code listing in the lawyers' offices? What
were the "secrets" he had learned? Bound by Judge Haden's protective
order, could he talk about them? On a Saturday night last December,
I drove from Charleston to Nunn's home, a ranch-style house in the
town of Poca, ten miles away. We talked in the den, where he had
an Apple Macintosh Plus on his desk.
Could he say whether he had found a Trojan horse, or more than
one? "The only thing that I'm restricted from doing is telling you
exactly the code that's in the program," he said. "It had lots of
fascinating little nooks and crannies hidden around in it that no
one has ever let me talk about. There are
at least a half-dozen places, maybe a few less, where you could
lay in a Trojan horse in that source code-lay in routines to do
whatever you wanted to in an election-because there's code in that
system that shouldn't be there, is not being used, is worthless
to the operation of the system. It can be replaced with anything
you want it to be."
Had Nunn found a trapdoor;
that is, a place in a program where one can break down its security
system and emerge undetected deep inside the program?
"Yes. There is one."
And had he found "wait loops" in the program
which conceivably could control outcomes, or "Christmas trees"-Nunn's
term for surprise packages in a program?
"They're all there. There
are wait loops there. There are routines that are not documented
in the manual and, from every way I can determine, do not work."
As we talked, Nunn got up from the couch, where
he had been sitting, walked to his desk, and sat down at the Macintosh.
"You continue to ask questions," he said. "I want to look for something
here. I've come up with an idea." After
about ten minutes, during which he went on answering questions,
he called me over to the keyboard and invited me to add on the computer
any numbers that came into my head. I added eight and thirteen,
then two multi-digit figures; the sums printed on the screen were
correct. "Now," he said from the couch, to which he had returned,
"add two and two." On the off-the-shelf program of this standard
brand computer two and two added up to five. In ten minutes, before
my eyes, Nunn had made a Trojan horse for me. He printed the five-step
program out and gave it to me. I still have it:
10 input x
20 input y
30 if x = 2 then x = 3
40 print "The sum of x + y is", x+y
50 go to 10
Line 30 is the Trojan horse inserted into the program
that makes two and two five. "I've told it every time it sees the
number two, replace it with a three," Nunn said.
I asked him if signs of these
various ways to interfere with the C.E.S. system could be kept out
of its audit trails.
"All of them can defeat the
audit trail, some of them better than others," he replied, with
some feeling. "Because, you see, built into that system is the ability
to turn the audit trail off. Every one of them you can turn off."
What about the test decks that are run through
the C.E.S. systems before and after elections?
"That is the biggest joke in the world," Nunn said.
"Anyone who knows how to run the C.E.S.
BT-76 system can be trained to steal an election on it in twenty
minutes. A summary card, anybody can do." Of the switches he said,
"As long as they are out there on the front of the machine and they're
turned on, someone has the ability to stop the machine and fool
with the panel switches.... You have no control over what's done
to the memory of the machine.
"But it's even more serious than that. I write
this program. I go through it. I'm absolutely sure that I know exactly
what it's doing. I compile it and punch a deck of cards and hand
it to you. We meet a couple of days later down here at the courthouse
and you run what you say is my program. There is no way on earth
that I can stand there and watch that computer run and swear in
a court of law that that is my program running. Now, it may have
the same input and output, but as far as swearing that it's my program,
I can't. I can't even look at the punch deck. Now, there may be
a few people in the world who can look at the punch deck for the
executable image"-that is, the program deck in object code-"and
read the punch cards and recognize the instructions, but I can't
do it. Damn few could. From that point of view, there
is no security."
That night, Nunn told me, step by step, how to
steal an election with the toggle switches that stick out of the
front of the Data General Nova computers in some C.E.S. systems.
"Briefly, using the toggle switches, what you do is you halt the
computer," he said. "You examine the memory address at which the
computer's halted-you make a note of it. You go to the memory location
that holds the counter of the candidate that you want. You load
the memory address for the candidate you want to fix into it, and
you say, `Load address.' Then you load the number of votes to give
him and then you say `Deposit.' That's wiped out his real count
and given him a fraudulent count right then. If you want to go someplace
else and do it-some other memory location-you do as many as you
want. You just do this until you're finished. Then you load the
address where the computer stopped. O.K.? And then you hit the button
for it to continue. The program continues on exactly the way it
was. There's nothing in the computer that- The computer never knows
it's been halted."
There is no printout on any audit tape, Nunn told
me. If a time-and-date record was maintained and someone noticed
that the clock was running late, that would be the only clue.
NO matter how deeply public officials may dedicate
themselves to it, the task of tightening up the security on Election
Night computers will remain a daunting one-and, if complete security
is the standard, impossible. The computer scientist Roy Saltman,
at the National Bureau of Standards, who is the leading authority
in the federal government on the subject, stresses in his new report,
"Accuracy, Integrity, and Security in Computerized Vote-Tallying,"
published in August, that no manipulation of election computer programs
has been proved, but he also warns of "the possibilities that
unknown persons may perpetrate undiscoverable frauds," by, for example,
altering the computer program or the control punch cards that manipulate
it, planting a time bomb, manually removing an honest counting program
and replacing it with a fraudulent one, counting faked ballots,
altering the vote recorder that the voter uses at the polls, or
changing either the logic that controls precinct-located vote-counting
devices or the voting summaries in these units' removable data-storage
units. The problem in this segment of the computer business, as
in the field at large, is not only invisibility but also information
as electricity. Secret instructions can be so well hidden in software,
especially if the language is the lower-level assembly, that testers
cannot be sure of finding them. Testing all the possible paths that
a computer program (and therefore a hidden code) could follow through
a punchcard ballot apparently could not be done comprehensively
short of assigning the job to a second computer, and even then one
runs up against what Robert Naegele has called "the polynomial problem"-the
vastness of the programming possibilities in the inner space of
a program. Mathematicians at Natre Dame, working with Deloris
Davisson, a computer specialist, have calculated that the number
of possible programming pathways for a program executed through
a standard punchcard ballot would be two to the nine-hundred-and-sixtieth
power-a one followed by two hundred and eightyeight zeros. "It's
a number that my computer can't hold," Davisson said. At the
merely mechanical level, computer experts in a large jurisdiction
cannot test punch-card systems for every voting possibility.
"It's an infinity as far as our work is concerned," said Rick Fulle,
assistant director of voting systems and standards for the Illinois
Board of Elections. "For our purposes, it just can't be done." When
a state examination of the C.E.S. system in Chicago was suddenly
scheduled, Fulle said, the chairman of the state board demanded
that all possible ballotpunch configurations be tested, but Fulle
figured out arithmetically that running through the sixty-seven
million-odd test ballots necessary would occupy twenty staff members
full time for four hundred and seventy-seven years.
IF one regarded the manifold
issues of computerized democracy in a reductionist way, perhaps
the principal concern would be whether, in a close election, the
Presidency can be stolen by means of computer vote fraud in several
Carr offered reassurance that although theoretically
such a calamity could occur, it would be extremely difficult technically
and would require too many confederates to be feasible.
Michael Shamos, the voting-systems
examiner for Pennsylvania, does not believe that a large number
of people would have to be involved. "This is false," Shamos replied
when I asked. "One. One person. The point is that, the way things
are going, a national mechanism exists that could be manipulated
by anybody, from a single individual to a nationwide conspiracy.
It's not whether it exists or not, it's the fact that the mechanism
is there to make it easy."
The leading candidates for the Presidency are seldom
separated by more than ten points, so "here's
what we do," Shamos said. "Working in a company headquarters, I'm
writing some election software, which will be sent by Federal Express
to jurisdictions in executable object code. I'm going to program
this thing so that if there are more than eight hundred people voting
in a precinct I'm simply going to trade some votes, take them from
other parties and dump them into the party that T want to win. So
all the totals are going to be exactly right. I'm going to change
ten per cent of the votes, or five per cent-some small number. And
that software is going out to pivotal jurisdictions in the country.
And that is going to shift the national election. It's easy for
a programmer. And his superiors will never find it. There's no way
to find it unless they do an exhaustive code audit themselves. And
this is a solo effort-one guy who happens to be well placed. Of
course, many others are involved, but they don't know."
If some jurisdiction that had been tested for
more than eight hundred votes discovered that the program didn't
count correctly, and returned it to the factory, the programmer
would simply say there had been a glitch on the tape, or a bad ROM-a
unit embodying "read-only memory"-"or some other technical mumbo-jumbo,"
Shamos went on. "And we have an election, and the wrong guy gets
elected." If recounts discovered errors in some localities they,
too, would be attributed to programming errors, he said.
Shamos believes it "not unlikely for some guy to
realize one day, he's sitting there in the room in the midst of
all those coding forms-he says, `My God! I can control this whole
thing!' " After all, Shamos said, "we have enough tales of hackers
who when they found they could do something went and did it, maybe
even not with malicious intent, just to show that they could do
He then pointed out a second possibility: "Of
course, you can imagine that the venders of the system are in with
certain politicians. The politicians agree, `Yes, I'll buy this
system, if you fix the election my way next time,' and they actually
give orders to their subordinates to do it. That's always seemed
somewhat less likely to me, because of the possibility of a whistle-blower.
Then, the third possibility is tampering by someone not in the employ
of the company, by a break-in at the vending company."
Summing up, Shamos said, "What does it mean that
one company is controlling a large fraction of the voting in the
United States? If you provide the software, you are controlling,
even if you are not manipulating. Computerized vote-counting doesn't
occur in the light of day, it occurs inside silicon in a little
black box. That box is completely under the control of the vender,
and if anything wrong happens we might never find out."
During an interview in a hotel lounge in San Francisco,
Roy Saltman said, "If I broke into B.R.C.'s master computer program
and changed the code, how about the nine hundred and ninety-nine
other versions that are already out there? It's not a massive, central
thing-all the computers are not connected to B.R.C. or to any single
vender. There isn't any kind of central control that controls everything.
I don't think that's a reasonable supposition. If you do the recount
of the ballots, the whole thing falls apart."
Robert Naegele believes that no one person could
steal an election by computer and, like Saltman, he does not regard
computerized theft of a national election as at all plausible. In
a large jurisdiction like Los Angeles County, Naegele told me, five
or six people would have to be involved, and hardly any jurisdiction
is so centralized that one person could do it there. "My private
opinion," he said, "is that there has never been any successful
fraud in a computerized election. As I understand it, it's really
not feasible. To do this, you require a hell of a lot of very sophisticated
code.... I am not concerned about fraud on the national level. I
don't think that's happened, and I don't think it's going to happen."
Like Carr, Peter Vogel, a computer lawyer in Dallas
who was recently appointed an examiner of computerized voting systems
by the Texas secretary of state, is skeptical that any conspiracy
among large numbers of people would work, but, like
Shamos, he thinks that the Presidency can be stolen by computer-"because
of the electoral college."
Vogel said to me in his office, "If
you have a majority in the right states, it doesn't matter who has
the majority of the votes in the country. If you program the right
states for the right elections, I think you could control the Presidential
Howard Strauss, of Princeton, gave me written answers
to a series of questions about the possible rigging of United States
elections by tampering with computer-tabulated election systems.
He said that "there are many, many ways to do this," but all of
them "can be largely eliminated" by rigorously followed procedures.
"If one software
vender dominates the electronic-election market, subverting that
vender may be the easiest way to alter national elections,
he wrote. One individual, working alone, would be able to effect
changes in the code more quickly and securely than a group, he believes.
What categories of people
might fix computers in elections? I asked. Strauss replied, "In
order of ease of subversion, some of the most likely groups or individuals
include election-system venders and their programmers and consultants,
election-system operators, the Federal Election Commission, technical
mavens of all kinds, and election officials and workers. It is possible
that foreign agents, candidates and their staffs, and voters with
special interests could subvert any of the above individuals or
have sufficient expertise to subvert the process themselves."
Peter Neumann, of S.R.I., declared, "If somebody
is a skilled user of a conventional computer system, he has the
ability to do almost anything he wants and leave no trace, because
most of the computer systems today do not have adequate protection
or auditing facilities. Personal computers are non-secure, for the
most part. Now, in the election systems
the vulnerabilities are enormous. You effectively have to trust
the entire staff of the corporation that is producing your software.
Every single member has to be trusted. It would take one person
to rig the system, typically, because of the way the thing is set
up. There are very few internal controls."
Speaking in his office at S.R.I., amid papers stacked
and scattered about on his desk and the floor and a chair nearby,
Neumann went on,"Even if you can look at
the source code, you can't guarantee that there's not a Trojan horse
embedded somewhere in the code. Any self-respecting system programmer
can hack the innards of the system to defeat encryption techniques
or any password protection, or anything like that. All this stuff
is trivial to break, for the most part. In most computer systems
out there, it is child's play. Given the fact that the underlying
systems are so penetrable, it is relatively easy to fudge data-for
example, to start out with three thousand votes for one guy and
zero for the other before the counting even starts, even though
the counter shows zero. Essentially a Trojan horse in the coding.
I can do it in the operating system. I can do it in the application
program. Or I can do it in the compiler. I can rig it so that all
test decks work perfectly well. I program it so that, after the
test is run, at, say, six-fifty-five in the evening, it simply adds
thousands of votes. It would never show up. He added
that having a computer count a set portion of one candidate's votes
as if they had been cast for his or her opponent would be "utterly
trivial to do."
As for stealing a Presidential
election, Neumann said, "I would put in a whole variety of techniques.
I wouldn't just rely on one. You might use a different technique
in each state, for example. You could trigger it so that you didn't
do anything wrong if everything was going well, and if your candidate
was losing you simply add votes-and you have to subtract, too. You
have to make all the consistency checks satisfy. That's relatively
easy to do."
Neumann exclaimed, "The possibilities are endless!"
He seemed to be enjoying them, but then drew bac.
"I think the possibilities for rigging elections with computers
are enormous. I'm not going to say it's ever been done. The point
here is it's in the hands of one very skilled programmer or somebody
who understands the system."
IN the face of such contradictory expert testimony,
it is all but impossible for laymen to ascertain the precise degree
of risk entailed by the use of computerized voting machines. Nevertheless,
given the crucial role of public confidence in the integrity of
the ballot, common sense suggests that the question should be resolved
definitively, by the press and, perhaps, by Congress. The press
has begun to grapple with the issue, thanks in part to a series
of articles by David Burnham in the Times a few years ago, and
press coverage of contested computerized election contests has contributed
to several reform efforts in the field.
With lever machines, the risk of vote-stealing
has always been relatively easy to reduce. In one of the rules that
Joseph Harris laid down in a model election-administration system,
published by the National Municipal League in 1930, no lever voting
machine could be used until it had been examined by "a competent
mechanic." It is also necessary in lever-machine precincts that
on Election Day candidates and representatives of parties be present
at least twice-when the voting starts, to make sure that the counters
are set at zero, and after the polls close, when the backs of the
machines are opened, to read the totals. These are the moments of
maximum opportunity for a vote-stealer: if he is not observed, he
can simply turn the counters to obtain a desired result.
In the opinion of many specialists, there is only
one comparably simple and effective way to deter fraud on Election
Day in most computerized jurisdictions: an immediate hand recount
of the ballots cast in a random group of precincts selected after
the vote-counting by various parties to the election. Such a recount
would be the greatest fear of anyone implicated in stealing an election.
When Harris reflected on the fact that computerized
punch-card elections could be manipulated, he advocated, as a remedy,
that every county and city using the Votomatic "set aside a number
of precincts to count by hand and to compare the results from a
hand count to the machine count." Who chooses the precincts? And
when- before or after the election-does anyone know which ones they
will be? Harris, in his model system, provided that "the candidates
should be permitted to designate the precincts which they wish to
have recounted and to amend and add to the list from time to time."
"A manual recount of at least one per cent of the ballots of each
contest is recommended," Roy Saltman wrote in his new report, and
he added, "Responsibility for selection of some of the precincts
to be recounted should be granted to candidates or parties." Michael
Harty, now the Maricopa County elections director, in Phoenix, and
the computer scientist Frederick Weingarten, of the congressional
Office of Technology Assessment, suggest that voters who doubt the
integrity of a computerized tabulation should, one way or another,
at once secure
the tabulating software as primary evidence.
Saltman also offered a set of recommendations that
are not so easily carried out: all vote-tallying software should
be obtained from an accountable source of stock offered publicly
by reputable venders and should be scrutinized for "hidden code;"
access to all stages of vote-tallying should be controlled; the
ballots themselves should be carefully monitored administratively;
every vote not cast by a voter in a race should be registered by
voting machines as not cast; the use of pre-perforated punch cards
should be ended, and perforations should be made unnecessary by
the use of spring-loaded styluses. (The last change would require
modification of the Voto-matics. ) More broadly, Saltman recommended
that the professional science of internal controls which is used
in business be adopted in vote-counting.
Naegele proposed to the F.E.C. that vote-counting
codes should be written in higher-level computer languages, because
they are "quite a bit easier" to analyze for error or, for that
matter, fraud. He told me, in California, that "the venders objected
to this strongly," saying the vote-counting goes much faster in
assembly (lower-level) language. A recent draft of the F.E.C. standards
would make the use of high level languages "discretionary only."
"What I wish," Naegele said, "is that some state would adopt a requirement
for higher-level language, so the others would follow."
Ken Hazlett, the programmer who pioneered in the
business with assembly language, expressed to me in Corvallis an
opinion even more emphatic than Naegele's about the use of assembly
language for computerized vote-counting: "Insane! It should
all be in high level language, so there's a chance it'll be readable
code twenty years later. There's no room for assembly except in
some small isolated process."
The concepts of putting source codes in escrow
and providing for their examination by independent test agencies
seemed well established in the recent F.E.C. draft. Michael Shamos
argued during my interview with him that escrow is not a workable
concept for protecting election software (among other things, he
wanted to know to whom private custodians of the code would be accountable),
but the proposal is popular.
A number of other remedies, in addition to those
in the studies by Saltman and the F.E.C's Clearinghouse, have been
suggested by individuals in the election community.
Terry Elkins, whose inquiries and accusations concerning
the 1985 mayoral race in Dallas led to the enactment of reform legislation
in Texas, maintains that election officials should be made more
accountable at law for their performances. Michael Harty, who suggested
that programmers of election computers should be licensed, emphasizes
the little-known fact that most state election laws are not mandatory
but "directory," and levy few or no penalties against officials
who do not obey them. Paul Goldy, the president of the International
Technology Group, of Woodbury, New Jersey, a smaller firm in the
computerized election market, advocates user groups for local election
officials, organized around specific products, like the groups that
many computer buffs belong to. Shamos has proposed that persons
who have criminal records for acts of "moral turpitude" should be
barred from the vote-counting-equipment business.
R. J. Boram, the chief programmer of the R. F.
Shoup Company, and Shamos advocate a high-prestige national election
commission to test and certify vote-counting systems, including
the software for them; Howard Strauss and a Princeton colleague
have prepared for Election Watch, a small group that is working
for change in this area, a specific proposal for a national testing
authority. At a conference in Dallas sponsored by Election Watch,
Strauss said that representatives of the venders and anyone else
who could change the counting program should be barred from computer
rooms on Election Night.
Some citizens believe that vote counting software
should be in the public domain, available to all parties and candidates,
for whatever checks they wish to make on it. "I'm not for a public
process being handled by private companies that won't let us see
what's going on," says Susan Kesim, a young executive of a computer-security
firm in Indiana. "Public-domain software -it's open. I want to see
that it added one to the total, because that's the process of voting."
"Maybe a private foundation should do it," Frederick
Weingarten has suggested. "Maybe if there was a consensus among
the states, the federal government could write its own software
and certify it through the National Bureau of Standards or the F.E.C.say,
`This we guarantee is accurate and untamperable.' "
Penelope Bonsall, the director of the F.E.C. Clearinghouse,
said of the public-software concept, "It's a public policy question;
it's too broad for us to consider. It would have to compete with
private interests. I don't know who would fund it. I just don't
see how you would eliminate private efforts in this area."
By 1984, the year before Joseph Harris, the exemplar
of the entrepreneurial approach to computerized vote-counting, died,
a subtle change had come over him. By then, lawsuits and accusations
were bedeviling his baby, Computer Election Services, Inc. In a
newspaper interview, Harris predicted that Americans would probably
vote on TV monitors in voting booths, and computers would announce
the winners minutes after the polls closed. But then he struck a
note new for him, adding that these changes would not come for about
twenty years, because such completely computerized voting would
require "extremely careful management and planning to prevent error
The new direct-recording electronic (D.R.E.) vote-counting
machines, which New York City is preparing to buy on behalf of its
three million registered voters, may become the realization of Harris's
vision of futuristic electronic voting. When citizens vote on one
of the D.R.E. systems, they address themselves to a printed ballot
affixed to the face of the machine or displayed on a TV-like console
and, with a finger or an electronic pointer, press on a box with
an "X" in it beside their choice. The four surviving bidders in
New York City are Cronus, Shoup, Sequoia Pacific, and, the one firm
offering a TV-like system, the Nixdorf Computer Corporation, which
is a wholly owned subsidiary of Nixdorf Computer, A.G., of West
Germany. The bidders had to provide the technological capability
to retain a record of "randomized" (that is, outof-sequence) electronic
images of each voter's set of choices, but the city reserved the
right to buy this capability or not.
Saltman's recent report indicated that the D.R.E.
systems have one characteristic that from a security point of view
may be even more important than the unavailability of real recounts
if a voter's choices are not retained electronically. Since
those choices are converted onto the counters inside the machines,
there is no way to check from the outside whether they are recorded
correctly. If the machine retained voters' choices on magnetic tape,
the tapes would not necessarily be correct. Saltman wrote, "The
fact that the voter can see his or her choices on a display, or
even receives a printout of the choices made, does not prove that
those were the choices actually recorded in the machine."
"There is no security
in using a computer to count ballots," Wayne Nunn told me the evening
he made me a Trojan horse. "I don't believe that computers should
be used to count votes. I believe that what you should use for counting
votes is a system that any voter can appreciate-in which he can
fully understand all steps of the process. There shouldn't be any
magic involved, because a computer system to the general populace
appears to be magic. You put something in one end and, voila -something
else comes out the other. A computer is such a flexible thing that
what happens between the time when you put it in and the time when
it comes out can be what any clever individual wants."
Real Scandal Is the Voting Machines Themselves
on election processes
Voting - Rebecca Mercuri, Ph.D.
Emphasis and links from Alllie