[House Hearing, 109 Congress] [From the U.S. Government Publishing Office] HEARING ON VERIFICATION, SECURITY AND PAPER RECORDS FOR OUR NATION'S ELECTRONIC VOTING SYSTEMS ======================================================================= HEARING before the COMMITTEE ON HOUSE ADMINISTRATION HOUSE OF REPRESENTATIVES ONE HUNDRED NINTH CONGRESS SECOND SESSION ---------- Hearing held in Washington, DC, September 28, 2006 ---------- Printed for the use of the Committee on House Administration HEARING ON VERIFICATION, SECURITY AND PAPER RECORDS FOR OUR NATION'S ELECTRONIC VOTING SYSTEMS HEARING ON VERIFICATION, SECURITY AND PAPER RECORDS FOR OUR NATION'S ELECTRONIC VOTING SYSTEMS HEARING before the COMMITTEE ON HOUSE ADMINISTRATION HOUSE OF REPRESENTATIVES ONE HUNDRED NINTH CONGRESS SECOND SESSION __________ Hearing Held in Washington, DC, September 28, 2006 __________ Printed for the Use of the Committee on House Administration U.S. GOVERNMENT PRINTING OFFICE 31-270 WASHINGTON : 2007 _____________________________________________________________________________ For Sale by the Superintendent of Documents, U.S. Government Printing Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512�091800 Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001 COMMITTEE ON HOUSE ADMINISTRATION VERNON EHLERS, Chairman ROBERT W. NEY, Ohio JUANITA MILLENDER-McDONALD, JOHN L. MICA, Florida California, CANDICE MILLER, Michigan Ranking Minority Member JOHN T. DOOLITTLE, California ROBERT A. BRADY, Pennsylvania THOMAS M. REYNOLDS, New York ZOE LOFGREN, California ------ Will Plaster, Staff Director George Shevlin, Minority Staff Director VERIFICATION, SECURITY AND PAPER RECORDS FOR OUR NATION'S ELECTRONIC VOTING SYSTEMS THURSDAY, SEPTEMBER 28, 2006 House of Representatives, Committee on House Administration, Washington, DC. The committee met, pursuant to call, at 10:03 a.m., in room 1310, Longworth House Office Building, Hon. Vernon Ehlers (chairman of the committee) presiding. Present: Representatives Ehlers, Ney, Doolittle, Millender- McDonald, Brady and Lofgren. Also Present: Representative Holt. Staff Present: Paul Vinovich, Counsel; Gineen Beach, Counsel; Peter Sloan, Professional Staff; George F. Shevlin, Minority Staff Director; Charles Tracy Howell, Minority Chief Counsel; Thomas Hicks, Minority Elections Counsel; Mathew A. Pinkus, Minority Parliamentarian, Janelle Rene Hu, Minority Professional Staff; Teri A. Morgan, Legislative Director, Office of Representative Brady; Stacey E. Leavandosky, Chief of Staff, Office of Representative Zoe Lofgren; and Joel Vanderver, Intern, Office of Representative Zoe Lofgren. The Chairman. Good morning, ladies and gentlemen. The Committee on House Administration will come to order. First I would like to advise and request all members of our audience here today that all cellular phones, pagers, and other electronic equipment must be silent to prevent interruption of our business. So I would appreciate it if you would turn these devices off, as I have. The committee is meeting today for a hearing on electronic voting machines and related issues. The election that will occur in just a few weeks will be the first general Federal election conducted since the Help America Vote Act of 2002, better known as HAVA, was fully implemented. That act, passed by this Congress in response to the voting system weaknesses exposed during the 2000 recount in Florida, set new standards for voting systems that were meant to make our elections more accurate and accessible. Three billion dollars were appropriated by the Congress pursuant to HAVA, with most of these moneys being dedicated to new equipment purchases by jurisdictions, localities, counties, cities, townships, et cetera, that wanted to improve their voting systems. As a result many jurisdictions are using new equipment for the first time this year. It is no surprise that there have been a few problems. Though HAVA did not require the adoption of any particular kind of technology, many jurisdictions purchased electronic voting systems because they felt these systems were best able to meet the requirements of HAVA. Not surprisingly, some jurisdictions using this equipment for the first time have encountered some difficulties. Just two weeks ago, in nearby Montgomery County, Maryland polls were not able to open on time because poll workers were sent to their posts without the cards necessary to start up the electronic machines. In the wake of this episode a column appeared in the Washington Post under the headline: If Paper Ballots Restore Trust in Elections, Let's Switch. The column noted people trust paper ballots because they are real. You can hold them in your hand and count them again if you need to. Indeed, before it had electronic voting systems, Montgomery County used a punch system. Need we be reminded of the problems we had with that system. I direct your attention to the screen above. The audience can look at that one, we will look at this one. This is a reminder of what we saw in the 2000 election in Florida, images of people with paper ballots. This one is a group of people staring at paper punch cards trying to figure out if they constitute a vote, and if so, for whom. If you look at the second slide, you see how closely these ballots were being examined by groups. And the third slide shows the extreme: putting things under the magnifying glass. You can see this man has got paper. Now, I am not showing these to condemn paper, I am just pointing out that punch cards with paper, rather thick paper at that, have caused some serious problems. Simply saying ``Let's use paper,'' as some people are saying, does not mean all the problems go away. We have to consider all the different aspects of it, and these pictures, as you can tell, were taken in Florida during the 2000 recount. That will go down in history, I am sure, because of the recount and the ramifications. These images do not inspire trust and confidence either in the punch card system or in voting systems in general. As we look at this problem, it is worthwhile to remember the famous words of H.L. Mencken who once said, ``For every complex problem there is an answer that is clear, simple, and wrong.'' We would like to have answers that are clear and simple, but we certainly do not want wrong answers, and so we are going to proceed with this very thoroughly and deliberately to try to make sure that we have good answers that are right. Unfortunately, the problem some jurisdictions have experienced with their new systems have caused some to suggest that we should revert to a reliance on paper, the so-called ``paper trail'' or ``paper tape.'' We know frompainful and bitter experience that paper systems also can fail to deliver accurate results and are susceptible to manipulation. To ignore this reality and assert that paper somehow ensures integrity or a correct result is simplistic and wrong. In fact, no voting system by itself can guarantee election integrity. The best system on earth will fail if not properly maintained, deployed and operated, and that is the key point that we have to remember. Even though I am a physicist and I have used computers since 1957, I am not saying by virtue of these comments that paper is bad. Electronics, of course, is good. I have used that for many years. I know that can fail too if not programmed or operated properly. I believe the important point is to design the best system you can, but make sure you have auditability built in, whether it is paper or some other electronic device. Our hearing will examine a range of issues related to electronic voting machines. We will hear about their problems but also about their benefits. We will also hear about the experience in one jurisdiction that tried to address the security concerns of a paperless system by requiring the machine to generate a paper trail. This hearing is being held to educate the members and the public about these complicated issues. I hope when the hearing is over, we will have a better understanding of the problems and benefits of these new technologies. I also hope that as we look for solutions to these complicated problems, we resist the temptation to settle on answers that are clear, simple and wrong. [The information follows:] [GRAPHIC] [TIFF OMITTED] T1270A.001 [GRAPHIC] [TIFF OMITTED] T1270A.002 The Chairman. Now I would like to ask unanimous consent that the gentleman from New Jersey, Representative Russ Holt, who is the author of a bill dealing very much with one aspect of this, be allowed to join us on the dais today and that he may be permitted to ask questions of the witnesses and enter his statement into the record. Without objection, so ordered. [The information follows:] [GRAPHIC] [TIFF OMITTED] T1270A.003 [GRAPHIC] [TIFF OMITTED] T1270A.004 [GRAPHIC] [TIFF OMITTED] T1270A.005 [GRAPHIC] [TIFF OMITTED] T1270A.006 [GRAPHIC] [TIFF OMITTED] T1270A.007 [GRAPHIC] [TIFF OMITTED] T1270A.008 [GRAPHIC] [TIFF OMITTED] T1270A.009 [GRAPHIC] [TIFF OMITTED] T1270A.010 [GRAPHIC] [TIFF OMITTED] T1270A.011 [GRAPHIC] [TIFF OMITTED] T1270A.012 [GRAPHIC] [TIFF OMITTED] T1270A.013 [GRAPHIC] [TIFF OMITTED] T1270A.014 [GRAPHIC] [TIFF OMITTED] T1270A.015 [GRAPHIC] [TIFF OMITTED] T1270A.016 [GRAPHIC] [TIFF OMITTED] T1270A.017 [GRAPHIC] [TIFF OMITTED] T1270A.018 [GRAPHIC] [TIFF OMITTED] T1270A.019 [GRAPHIC] [TIFF OMITTED] T1270A.020 [GRAPHIC] [TIFF OMITTED] T1270A.021 [GRAPHIC] [TIFF OMITTED] T1270A.022 [GRAPHIC] [TIFF OMITTED] T1270A.023 [GRAPHIC] [TIFF OMITTED] T1270A.024 [GRAPHIC] [TIFF OMITTED] T1270A.025 [GRAPHIC] [TIFF OMITTED] T1270A.026 [GRAPHIC] [TIFF OMITTED] T1270A.027 [GRAPHIC] [TIFF OMITTED] T1270A.028 [GRAPHIC] [TIFF OMITTED] T1270A.029 [GRAPHIC] [TIFF OMITTED] T1270A.030 [GRAPHIC] [TIFF OMITTED] T1270A.031 [GRAPHIC] [TIFF OMITTED] T1270A.032 [GRAPHIC] [TIFF OMITTED] T1270A.033 [GRAPHIC] [TIFF OMITTED] T1270A.034 [GRAPHIC] [TIFF OMITTED] T1270A.035 [GRAPHIC] [TIFF OMITTED] T1270A.036 [GRAPHIC] [TIFF OMITTED] T1270A.037 [GRAPHIC] [TIFF OMITTED] T1270A.038 [GRAPHIC] [TIFF OMITTED] T1270A.039 [GRAPHIC] [TIFF OMITTED] T1270A.040 [GRAPHIC] [TIFF OMITTED] T1270A.041 [GRAPHIC] [TIFF OMITTED] T1270A.042 [GRAPHIC] [TIFF OMITTED] T1270A.043 [GRAPHIC] [TIFF OMITTED] T1270A.044 [GRAPHIC] [TIFF OMITTED] T1270A.045 [GRAPHIC] [TIFF OMITTED] T1270A.046 [GRAPHIC] [TIFF OMITTED] T1270A.047 [GRAPHIC] [TIFF OMITTED] T1270A.048 [GRAPHIC] [TIFF OMITTED] T1270A.049 [GRAPHIC] [TIFF OMITTED] T1270A.050 [GRAPHIC] [TIFF OMITTED] T1270A.051 [GRAPHIC] [TIFF OMITTED] T1270A.052 [GRAPHIC] [TIFF OMITTED] T1270A.053 [GRAPHIC] [TIFF OMITTED] T1270A.054 [GRAPHIC] [TIFF OMITTED] T1270A.055 [GRAPHIC] [TIFF OMITTED] T1270A.056 [GRAPHIC] [TIFF OMITTED] T1270A.057 [GRAPHIC] [TIFF OMITTED] T1270A.058 [GRAPHIC] [TIFF OMITTED] T1270A.059 [GRAPHIC] [TIFF OMITTED] T1270A.060 [GRAPHIC] [TIFF OMITTED] T1270A.061 The Chairman. Welcome, Representative Holt. We are pleased to have you here. This is one of the few times in the Congress when you will find two physicists sitting at the front desk listening to testimony. At this time, I would like to recognize the Ranking Member, Ms. Millender-McDonald, for any opening remarks she may have. Ms. Millender-McDonald. Thank you, Mr. Chairman, and good morning to you and all the witnesses and guests here this morning. I would like to thank you, Mr. Chairman, for calling this very important hearing on electronic voting machines. I am sure that you have heard from your constituents and constituents around the country, as I have heard, that folks are wary about these voting machine apparatuses and they are not sure whether or not they are working. Let me also thank you, Mr. Chairman, for welcoming Congressman Russ Holt to sit on the panel this morning. It was just 6 years ago that the 2000 Presidential election brought to light many problems with the elections process in our country. We encountered a wide range of frustrations with the election administration. Some of the most infamous problems involved punch cards with all of the hanging chads that the Chairman has just shown you. Others involved voters who were turned away from the polls without the opportunity to cast a vote. In response, this committee worked diligently and passed the Help America Vote Act, which is HAVA, to rid the country of outdated voting equipment and to ensure no eligible voter is turned away from the polls without casting a vote. Despite the passage of HAVA, however, many problems still remain, as we witnessed during the 2004 election and in several primaries this year. Today I hope to hear about methods of addressing these issues, even if we may not be able to implement suggested recommendations before the November election. I also hope that this oversight hearing will serve as a forum for the American people to gain confidence in direct recording electronic voting system machines. After the 2000 election, DRE, as we call them, machines were viewed as the answer to hanging chads and century-old lever machines. DRE machines also allowed individuals with disabilities to vote in private and without assistance for the first time. They have also been supported by a number of civil rights organizations, given the ease with which they are able to be programmed to display ballots in foreign languages. However, as we are aware, many concerns have been raised about the integrity and the reliability of these DRE machines. In fact, at times it may be seen that thesemachines have raised many more questions than answers. For example, some have called for a voter-verified paper audit trail for DRE machines. Some States already require this function for DRE machines. But even this similarly simple method raises numerous concerns. For example, when mechanisms serve as the official-- what mechanism serves as the official record in a recount? That is a question that has been raised often. What happens when the printer jams? Would the votes which were properly recorded by the DRE be thrown out if they are not similarly recorded on the paper? Those are the questions that have been raised often. I am also interested in hearing from our witnesses, especially the local election officials, regarding their views about the wisdom of imposing a Federal mandate which would specify which type of election equipment should be used. These decisions have mostly been left up to the State and local officials throughout our country's history, and I would like to know what the impact of a Federal mandate and a standard in this area would be, what precedent it would set for future election administration mandates on the States by the Federal Government, and how these mandates would be funded. In addition to discussing established concerns about DRE machines, I hope the witnesses invited today will address the security of all voting equipment. Only one-third of Americans will cast ballots on DRE machines, and although that number is growing, it still means that two-thirds of our voters will be casting ballots using other methodologies. Are these machines secure, are they reliable, are they subject to a suitable level of scrutiny? I am concerned that all of the media attention to voting security will inadvertently discourage voters from going to the polls, resulting in voter suppression. As we witnessed a few weeks ago in Maryland, voting machine reliability, stability and accuracy was not the inherent cause of mayhem. The lack of poll-worker training and other human factors of election administration caused problems and confusion at the polls for both voters and poll workers. If we do not adequately address all of these issues, voters may feel as if their votes will not be counted and decide not to participate on election day. This is one reason why I offered an amendment to double the funding for the college poll-worker training program. This program encourages college-age students to serve as poll workers and to become more involved with the election administration process. The electoral process is not perfect, Mr. Chairman. Improvements to the electoral process itself still need to be made. Fortunately, the Help America Vote Act of 2002 is a solid foundation upon which we can institute further electoral improvements. HAVA made it easier for voters to cast a ballot and harder for people to knowingly commit crime and fraud, which is why we need to appropriate the remaining $800 million balance which was authorized in title 2 of HAVA to fully fund the States and give HAVA a chance to work. As I have stated in the past, it is guaranteed that your vote will be lost if you don't cast a ballot. I would encourage every eligible voter to cast a ballot, no matter how harsh the rhetoric about the November elections and no matter how that ballot is cast: by DRE machines, absentee ballots, provisional ballots or whatever. Americans need to get out in November with the confidence that their vote will be counted correctly. Exercising this precious right is more important than the outcome of the elections, Mr. Chairman. I hope we can convene additional hearings in the future to examine any shortcomings in election administration and any impediments that voters experience in exercising their constitutional rights. I look forward to working with the Chairman and other members to continue to improve the voting process and I will continue to seek full funding of the Election Assistance Commission title 2 grants to ensure that the EAC can continue its crucial work to improve the electoral process. Even if one voter is disenfranchised, that is one voter too many. Thank you, Mr. Chairman. [The information follows:] [GRAPHIC] [TIFF OMITTED] T1270A.062 [GRAPHIC] [TIFF OMITTED] T1270A.063 [GRAPHIC] [TIFF OMITTED] T1270A.064 The Chairman. I thank the Ranking Member for her comments, and I especially want to reinforce something you said. Voting in this nation has traditionally been controlled and operated by the local municipalities, cities, townships, counties and by the states. The only reason the federal government entered this is because of the problems with a federal election of a president in 2000, and we continue to have great respect for the localities and the States which have the responsibilities for implementation. We are simply trying to establish standards only for the federal elections. Ms. Lofgren, do you have an opening statement? Ms. Lofgren. Thank you, Mr. Chairman. I am glad that we are having this hearing today and delighted that we are joined by our colleague, Mr. Holt, the author of H.R. 550. I am inclined to think that Mr. Holt's approach is the right one, but I have declined to be a coauthor of this bill until this hearing because I wanted to try and keep an open mind on this subject and listen to the witnesses, without being a coauthor of the bill. But coming from Silicon Valley, you can imagine that I have had considerable input from people who are quite skilled, and I guess the question that needs to be answered is can this election be hacked. There are many issues, I am sure we will get into them today, but the integrity of the election process isabsolutely essential to the sustenance of a vigorous democracy. Elections do count, as we know. And the direction that our country is going in will be decided by elections. If we can't know for a certainty that that process is not corrupted, then it really goes to the core of the spirit of our Nation and our future as a democracy. So I realize we are not in a markup mode here today, we are here to get information. I am going to listen very carefully to all the witnesses, but I am hopeful that we could take quick action because this--my own State of California has already moved in the direction that Mr. Holt is suggesting with the verifiable paper audit trail. We need to be able to let the voters of America know that their elections are on the up-and- up and their vote really does count and the election has not been hacked. So with that, Mr. Chairman, I thank you for holding this hearing and I will yield back because I am eager to hear a very large panel of witnesses before we are called to vote. Thank you very much. The Chairman. Thank you for your statement. Mr. Holt's statement will be entered into the record as we mentioned earlier. In setting up the panel for this hearing I was determined to try to get the broadest representation possible. I would have had to have 27 witnesses to totally accomplish that, but the fact is that we have tried very hard, as indicated by the large number of witnesses we do have. I am very pleased with the quality of the witnesses who agreed to appear and we now turn to Dr. Felten for his testimony. He is a professor in the Department of Computer Science at Princeton University, which also happens to be Mr. Holt's district. He recently completed a study of an electronic voting system and will give us a report on his findings. I also understand you have a demonstration for us, Dr. Felten. You may begin. STATEMENT OF EDWARD W. FELTEN, PROFESSOR, DEPARTMENT OF COMPUTER SCIENCE, PRINCETON UNIVERSITY Mr. Felten. Thank you, Mr. Chairman, and members of the committee for the opportunity to testify today---- Ms. Lofgren. Mr. Chairman, there are lights on that. Is there a way--much better. Mr. Felten. From a security standpoint what distinguishes computerized voting systems from traditional systems is not that computers are easier to compromise but that the consequences of compromise can be so much more severe. Tampering with an old-fashioned ballot box can affect a few hundred votes at most, but injecting a virus into a single computerized voting machine can potentially affect an entire election. Two weeks ago my colleagues, Ariel Feldman and Alex Halderman, and I released a detailed security analysis of this machine, the Diebold AccuVote-TS which was used in Maryland, Georgia, and elsewhere. My written testimony summarizes the findings of our study. One main finding is the machines are susceptible to computer viruses that spread from machine to machine and silently transfer votes from one candidate to another. Such a virus requires moderate computer programming skills to construct. Launching it requires access to a single voting machine for as little as 1 minute. I will now demonstrate this using a virus we constructed in our laboratory. We have set up here a simulated election for President between George Washington and Benedict Arnold. It is election day morning and we just opened the polls. No votes have been cast yet. I will start by casting the first vote. When I checked in at the polling place at the front desk, the poll worker gave me this voter card which I now insert into the machine. I press the start button and I choose to cast my vote for George Washington. The machine asks me to confirm my choice and I confirm my choice and cast my ballot. The second vote is similar. I insert another voter card, I choose George Washington again, and again I confirm and cast my ballot. The third voter inserts another voter card and votes again for George Washington. The correct vote count in this election obviously is George Washington, three; Benedict Arnold, zero. Now it is the close of election day. A poll worker inserts a special supervisor card into the machine, enters a PIN code, and tells the machine to end the election and tally the votes. The machine will now print out a paper tape summarizing the ballot count. When I cast my votes earlier my choice of candidate was recorded in the machine's electronic memory. This record of my vote was invisible to me. I had no way of verifying whether it was recorded correctly or whether it was changed after it was recorded. In this machine the records were modified by our virus. This paper tape printed out by the machine reports the elections result. It shows George Washington with one vote and Benedict Arnold with two. Every record in the machine and outside the machine is consistent with this fraudulent result. Our technical report referenced in my written testimony goes into considerable detail about this problem and explains why existing election procedures are not sufficient to prevent it. One lesson is that security depends on getting the technical details right. Too often the designers of this machine fail to get the details right. A good example is the access door here on the side of the machine. It protects the removable memory card that stores the votes, so the door should be locked securely and access to the keys should be strictly limited; but in fact tens of thousands of AccuVote machines can all be opened with the very same key, and this very same key is used widely in office furniture, jukeboxes and even hotel minibars. It is easily purchased on the Internet. This one I bought online from a jukebox supply shop and it does open the machine. The implications of our study go beyond just this machine and reveal broader systemic problems. More worrisome than any specific vulnerability is that this system, despite its many problems, was certified, purchased and deployed by many States and counties and has been used in important elections. We can do more to improve the security of our e-voting. I detail many recommendations in my study and written testimony, but one important safeguard is a voter-verifiedpaper audit trail. A well-designed paper trail can improve security and enhance voter confidence without compromising accessibility. Certainly paper records have their drawbacks, but they have different failure modes than electronic records do and the combination of electronic and paper records can be more robust against fraud than either one would be alone. Getting the details of voting right is difficult, especially in today's high-tech polling place, but failure is not an option. The stakes are too high and the risk of malfunction or fraud too great to make our current course tenable in the long run. Election experts, accessibility experts, and computer security experts all have a role to play in improving our voting system. If we work together we can solve this problem and give the American people the voting system they deserve. Thank you for your time and attention. The Chairman. Thank you very much for your testimony. [The statement of Mr. Felten follows:] [GRAPHIC] [TIFF OMITTED] T1270A.065 [GRAPHIC] [TIFF OMITTED] T1270A.066 [GRAPHIC] [TIFF OMITTED] T1270A.067 [GRAPHIC] [TIFF OMITTED] T1270A.068 [GRAPHIC] [TIFF OMITTED] T1270A.069 [GRAPHIC] [TIFF OMITTED] T1270A.070 [GRAPHIC] [TIFF OMITTED] T1270A.071 [GRAPHIC] [TIFF OMITTED] T1270A.072 [GRAPHIC] [TIFF OMITTED] T1270A.073 [GRAPHIC] [TIFF OMITTED] T1270A.074 The Chairman. Our second witness is Gary Smith. Mr. Smith is the election director in Forsyth County, Georgia. Georgia uses a paperless DRE system statewide, and for those who don't know what DRE stands for it is direct recording electronic computer. Basically it is a type of computer we have displayed here. Mr. Smith uses a Diebold system that was the subject of the Princeton study. Mr. Smith also participated in the recount of the Cuyahoga County primary conducted on a DRE system with a paper audit trail. Mr. Smith, you are recognized. STATEMENT OF GARY SMITH, ELECTION DIRECTOR, FORSYTH COUNTY, GA Mr. Smith. Well, as was mentioned, my name is Gary Smith, I reside---- The Chairman. Is your microphone on? Mr. Smith. My name is Gary Smith and, as you mentioned, I am the election director for Forsyth County, Georgia, a county just north of Atlanta. It is quite a fast-growing county. We have about 80,000 registered voters and we are one of the top fastest-growing counties in the United States, so we have a lot of issues that we have to deal with all the time. One of the things I think that is important maybe is to look at what those of us as election directors--how we come about. I am actually appointed through a selection committee that comes about where a grand jury is brought forth, they pick a panel of people who have the background to be able to do this. It is then sent up to the chief superior court judge and then I am selected from that. I was selected from that process. I am in my second term as the director of elections. It is a term of 4 years, and it is a nonpartisan position. Prior to coming into this position I spent most of my time working in the private sector. I retired. I was running various companies, and I have worked most of my life in industrial automation. So I have a technical background. I have an undergraduate degree in electrical engineering and I am a certified election registration administrator from a program administered by Auburn University. As a director of elections, one of the things that I have been privileged to do is to sit on a task force, several of them. One has been from the Georgia task force, which allows me to be able to participate and look at new processes and equipment that we apply to elections in our county and State. In addition to that, I served on a national task force for election reform for 2004 where we looked at all the processes across the country with regards to elections. In addition, I think you just mentioned I did lead the manual recount for the Cuyahoga County VVPAT so I have some practical experience with that and I was happy to be able to do that. I spent a week at it, as a matter of fact. We have implemented the DREs. The one that you are looking at right here, which is the Diebold-TS unit, my county and 158 counties in Georgia implemented this during the general election of 2002. We have held, from what I heard was the last count, something like 2,500 elections in our State. In addition to that I have held elections on special elections, primaries, general elections, run-offs and just about any kind of election, and a municipal election as well. So, again, we have a lot of experience with them. One of the things that I think has been talked about a lot and I think we have to deal with is how do you look at the security and integrity of this kind of equipment. It starts, obviously, with the vendor who builds the equipment, goes through the independent testing laboratories that then look at it to make sure what we are receiving has the technical wherewithal to be able to provide us with a piece of equipment that really meets what our needs are. Thirdly, we have in our State, which I am very proud to talk about, the Center for Election Systems, a program administered by Kennesaw State University and Dr. Britt Williams, a well-known authority in elections. We do all of our creation of our ballot cards and that sort of thing through this group, and so it is another level of testing that we have that goes on. Lastly, it is up to those of us who are election directors to hold these elections, so I am tasked with a lot of the things that Mr. Felten has talked about, which is maintain the security and integrity of the process that goes on with elections. I guess we are where the rubber meets the road as much as anything. So that is our job. I am not going to go through all the details with regards to certification because it is certainly going to take a lot more than a few minutes, but it is in my paper and I hope that you will look at it. I think where we pick it up is where we pick up the memory cards, as Mr. Felten has mentioned, that come to us from the Center for Election Systems, the process of making sure that they come to us under the chain of custody manners, that we know that there is at least more than one person that has access to what we are talking about and they are looking at. We go through a process called logic and accuracy testing. This is when the process that he has talked about goes through the first part, where we are taking the memory cards, we are marrying them essentially to the voting machine, and then we are taking them through the testingprocess, at which time then we lock the machines up and we pass them on to the next level, which really is the election poll worker himself. And what I would like to do is to show you some of the chain-of-custody forms and I think they are in front of you too. If they are not, I am going to show you one actually that is going to be--okay. It is as good as it can get up there but I think most of you can probably see it. What I am pointing out in it--is it okay if I stand up? The Chairman. As long as you carry the microphone with you so all the people in the overflow room can hear you too. Mr. Smith. Can you hear me now? The Chairman. Yes. Mr. Smith. All right. I think what is critical about this, I think this is one of the things maybe that because we are doing it statewide, we have an awful lot of good chances to be able to work the processes out. And I think Mr. Felten, one of the things he said is you need to have good chain of custody in these things. This actually is for the precinct Big Creek. This is actually an actual form that we are using. It says here item number 1, custodian certification form for the AccuVote-TS units that are going to be used. Under point number 2 what I have got here is the touch screen serial number, which has not got a number in here, 116827. Then across here what you are looking at is all of the tests that we take individually to run on the machines. This takes about 15 minutes per machine to run. It is a process that is done under my direction, and we actually have done this for 500 machines for the upcoming election. The next point that is important to look at is there is a seal number that is right here. That seal number, what I am going to show you is how it is carried forward to the process where when we are holding the election at the precinct, what happens with it. This machine then is sealed up, it has a wire serial number on it. So there is no access to this machine once the logic and accuracy test is done. Now, the next form I am going to show you is right here. This is a form then that is carried forward to the precinct itself so that when the poll workers, poll manager and his assistant, this is their responsibility; this is a form that is signed in triplicate, one goes to the Secretary of State, one goes to me and one goes to the clerk of the superior court. You will notice again it is for precinct Big Creek 01. This is the recap sheet that goes with it. Here again is the serial number. If we had looked back before, we would find that that serial number is the same one as here. Here is the serial number that then shows up on--that is transferred from the original L&A testing. Now what happens with it is we open up the machines, we go through it, we do the count number, and then at the end of the election, because this is the recap sheet, the key part here is that there is another mechanical low-tech seal put on it. It is a wired seal so it is kept on there all the time. That is the process that we go through. I wanted you to be able to see that. The Chairman. I am going to have to ask you to wrap up because we have a lot of witnesses and a lot of discussion. Mr. Smith. Okay. I am sorry. The Chairman. Is that it? Mr. Smith. The other part I wanted to talk about, and I think this has to do with the comments that Ms. Millender- McDonald said, is what is the confidence that people have in it. I would like to at least respond to that at another time, because we have done surveys in our county, too, which show that 99 percent of the people feel that the process is an excellent process. So there is a high level of confidence in our equipment. The Chairman. All right. We can defer that to the question period. Mr. Smith. Thank you very much. The Chairman. Thank you. [The statement of Mr. Smith follows:] [GRAPHIC] [TIFF OMITTED] T1270A.075 [GRAPHIC] [TIFF OMITTED] T1270A.076 [GRAPHIC] [TIFF OMITTED] T1270A.077 [GRAPHIC] [TIFF OMITTED] T1270A.078 [GRAPHIC] [TIFF OMITTED] T1270A.079 [GRAPHIC] [TIFF OMITTED] T1270A.080 [GRAPHIC] [TIFF OMITTED] T1270A.081 [GRAPHIC] [TIFF OMITTED] T1270A.082 [GRAPHIC] [TIFF OMITTED] T1270A.083 [GRAPHIC] [TIFF OMITTED] T1270A.084 [GRAPHIC] [TIFF OMITTED] T1270A.085 [GRAPHIC] [TIFF OMITTED] T1270A.086 [GRAPHIC] [TIFF OMITTED] T1270A.087 [GRAPHIC] [TIFF OMITTED] T1270A.088 [GRAPHIC] [TIFF OMITTED] T1270A.089 The Chairman. As a reminder to those, I should have mentioned it before, you have the little device in front of you with the lights on it. Green means go, yellow means sum up, red means you are in deep trouble. So please keep an eye on the clock. Next I am pleased to recognize Ms. Barbara Simons, past president of the Association for Computing Machinery, and she has done a lot of work on voting systems. Dr. Simons, you are recognized. STATEMENT OF BARBARA SIMONS, MEMBER, U.S. PUBLIC POLICY COMMITTEE, ASSOCIATION FOR COMPUTING MACHINERY Ms. Simons. Good morning, Mr. Chairman, members of the committee. On behalf of the computing professionals that constitute the Association for Computing Machinery I want to thank you for the opportunity to testify today about e-voting system security and the need for voter-verified paper trails. Secure, reliable, usable and accessible voting systems are critical toward assuring transparent, fair and inclusive elections. These are not mutually exclusive goals. I shall discuss aspects of both security and accessibility this morning. First, security. Because of the risks of software bugs, malicious code or computer failure, we cannot trust that the results in a paperless voting machine accurately reflect the will of the voters. That is why voter-verified paper ballots or audit trails (VVPATs, as we refer to them) are needed. VVPATs are automatically produced by an optical scan system, since the ballot is verified by the voter. Fortunately, 48 percent of counties have optical scan systems so they already have VVPATs. Optical scans can be used together with tactile ballot sleeves or accessible marking devices for accessibility. Some DREs have been retrofitted to produce VVPATs; in fact, all of them for use in California, as Congresswoman Lofgren said. Two years ago ACM, a leading computer society, issued a statement calling for well-engineered voting machines that allow every voter to verify his or her record has been accurately cast by the inspection of a physical (e.g. paper) record. At its 2006 national convention, the League of Women Voters passed a resolution calling for voter-verified paper ballots or records to be used for audits and recounts. The League also urged that routine random audits be conducted in every election. Both the ACM statement and the League's resolution can be found in my written testimony. In summary, as a defense against malicious or buggysoftware we must have: reliable, well-engineered VVPATs, policies and procedures that guarantee the integrity of the paper records; security storage and delivery of machines and so on, mandatory random manual audits of VVPATs; and a full manual recount if discrepancies are uncovered, unless there is evidence that the VVPATs have been compromised. I will now discuss accessibility. People with disabilities should be able to vote privately and independently and be able to verify their votes. HAVA does not require the DREs be used for accessibility. There is evidence that a number of people with disabilities are finding that DREs are not meeting their accessibility needs. Kelly Pierce, a nationally known advocate for the blind and visually impaired, reviewed tactically discernable controls, spoken prompts, visual display, poll worker assistance, volume control and normalization, and ballot review for four voting machines. In his report for Cook County State Attorney's Office, Pierce concluded that if any one of the four machines were to be deployed in Chicago or suburban Cook County, many voters with disabilities, particularly blind voters, would not be able to cast a ballot independently and privately. Blind computer scientist Noel Runyan discussed his frustration with his hour-long voting experience in the 2004 Presidential election, and I quote: It took me 30 minutes to work my way through the ballots and make my selection. After that I had quite a bit of trouble getting into the review mode to get a full list of all my selections. When I did, it went on and on for 23 minutes, like a long uncontrolled drink from a firehose. The review function read each item and then at the very end said my selection was for that item. It even threw in details of what the fiscal impact would be and took forever. ``This is completely backwards.'' He went on to say: ``From the time I signed in and got my voter smart card, it took 8 minutes to reboot the audio voting machine; 30 minutes to make my choices; 23 minutes to review and verify; and another 4 minutes to make a correction and record my vote. Not counting the hour waiting in line, it took me about 65 minutes to mark and record my ballot.'' We do not have to settle for inaccessible voting systems. Old technologies such as text to audio devices, tactile ballot sleeves, and ballot market and generating systems could be combined with new technologies that make the entire voting and verification process accessible, while remaining auditable. Technology, if engineered and tested carefully and if deployed with safeguards against failure, can reduce error rate, provide more accessibility, increase accountability and strengthen our voting system. However, the current state of e- voting technology leaves us far short of these goals. We need paper trails and manual audits to protect us against failures and attacks. We need additional research to make voting machines more usable, secure and accessible. And we need to work together to achieve these goals. Thank you. The Chairman. Thank you very much. [The statement of Ms. Simons follows:] [GRAPHIC] [TIFF OMITTED] T1270A.090 [GRAPHIC] [TIFF OMITTED] T1270A.091 [GRAPHIC] [TIFF OMITTED] T1270A.092 [GRAPHIC] [TIFF OMITTED] T1270A.093 [GRAPHIC] [TIFF OMITTED] T1270A.094 [GRAPHIC] [TIFF OMITTED] T1270A.095 [GRAPHIC] [TIFF OMITTED] T1270A.096 [GRAPHIC] [TIFF OMITTED] T1270A.097 [GRAPHIC] [TIFF OMITTED] T1270A.098 [GRAPHIC] [TIFF OMITTED] T1270A.099 The Chairman. Next we turn to Mr. Keith Cunningham who is the election director in Allen County, Ohio. He serves on the board of advisors to the Election Assistance Commission and also participated in the Cuyahoga County recount study performed by the Election Science Institute. Mr. Cunningham, you are recognized. STATEMENT OF KEITH CUNNINGHAM, ELECTION DIRECTOR, ALLEN COUNTY, OH Mr. Cunningham. Thank you, Mr. Chairman, and let me say what an honor it is for a guy from a small town in Ohio to be sitting here before you today in this tremendous forum. I am also the immediate past president of the Ohio Association of Election Officials, and I want to say to you before I begin, when I wake up in the morning and head for my job I am feeling pretty good about it. I believe the job that I am involved in, which is an elections director, has meaning and has merit and is doing things to make our country and our community better. One thing I think we all agree on is that electronic voting needs some type of verification system, some component that allows it to be audited. And of course all systems need that, but as my predecessors have said, a hard ballot system is rather obvious how we audit those. Personally I do not have any particular aversion to voter-verified paper audit trails. However, in Ohio the system is that the voter-verified paper audit trail becomes the official ballot of record for recount purposes. I must say to you, clearly I am adamantly opposed, based on the experience I have had in Cuyahoga County, to that. I believe that program is setting election officials up for failure at this point in time. If the VVPAT was to be extended to voters as a courtesy by which to check their votes, I have no problems with that. I think statistics indicate voters don't even use it when it is available to them. The studies on hand show that maybe less than 10 percent of the people actually utilize that. We looked at approximately 350 VVPAT tapes in Cuyahoga County, and over and over and over we encountered tapes that were missing, that were in some way compromised. You have the numbers before you, so I won't bore you with the statistics, but I think two of them are very important for you to remember. Nearly 17 percent of the VVPAT tapes reviewed by that team--and that team consisted of a lot of Ohio election officials that came in to help participate--nearly 17 percent of those tapes showed a vote discrepancy of one to five votes from the electronic machine, and nearly 10 percent of those tapes were either destroyed,blank, missing, taped together, or in some other way compromised. My point is this: that when you use the VVPAT at this point in time as the official record of a recount vote, it actually serves to disenfranchise the voter because votes are lost in the VVPAT process. They are simply not there and cannot be retrieved. We could have retrieved those votes by other means from those machines, but in Ohio we are not allowed to because the recount official ballot of record in a recount becomes the VVPAT. So I would submit to you that it was the paper that actually caused the count to be in question. Additionally, and we have some photographs here I would like to show you, there is no reliable technology for which to recount VVPATs. To ESI's credit they had a makeshift kind of crank thing that you could put the tapes in and reel them up. These things are sort of like wrestling octopuses. As you can see--let's go to the next one, the next one. These are some of my friends. This is just kind of the scene. There you can see the machine. I will tell you what I equate this to. We are pretty agricultural in my part of Ohio. I equate this to planting several hundred acres of wheat with a million-dollar planting machine and harvesting it by hand like the Amish used to, and stacking it up in the fields. This was mind-numbing, to say the least. Now keep in mind we went through 300-some tapes. There were probably near 4,000 tapes in Cuyahoga County. This took us two 10-hour days, actually 2\1/2\ because the first half day was upsetting the system. Continue, please. This is simply a tape with no record printed on it. Continue again, please. Same thing. This is the information that we are looking through on the tapes trying to--and, remember, at least this is Ohio's rule, that when you recount a race, you can't recount any other race. You can only recount the race that is going to be recounted. So if you have got 27 candidates on the ballot, you have got to reel through all 27 to get to the race, maybe a down ballot race. This is an example of one that is taped together that has obviously been in the machine, it accordioned in the machine. I don't know, that black line probably represents 20 or 30 votes. There was no way to reconcile that. There is another torn tape, another shot of the crude machine we were using to do this. I think they speak for themselves. I honestly don't have any reason to believe DREs don't record votes accurately but I understand the concerns and I do believe that we should have some kind of audit system for it. I would say to you, considering the size and scope of the deployment of voting machines in the last 12 to 24 months in America, I think election officials have done a pretty darn good job. We are working on improving it. Unfortunately, I believe--and I will wrap up here in just a second--I believe it is the environment which is slowing our pace of improvement. As a local election official I am going to tell you, I feel like I am in a cross-fire, and I know many of my colleagues do; and that cross-fire is a very, very polluted conversation, and it is being polluted with political interests, corporate interests and scientific one-upmanship. And I often wish I had as many people helping me find the solutions as I did identifying the problems. It would make my job an awful lot easier. I want to echo the remarks earlier, that I do believe we should continue to fund HAVA. I think the underfunding of HAVA sends a very inconsistent message to those of us out there trying to do this on a daily basis. I would say to you also, please allow us to finish what has been started and what is in motion before we begin to tinker with this. We have been given a set of tasks that are very, very hard to manage. And, again, in the scope of the deployment that has taken place in this country, I don't want to say there weren't problems in it, but I think my colleagues have done a very good job and I would hope that in the future when we do begin to debate and speak about this, we can do it in on honest and direct terms, without misrepresentations, half truths, and focus on what it is we need to do to cure these problems and make America's elections--give people confidence in them. I think it is too far to--too much to expect any less than that. Thank you for your time. I appreciate it. The Chairman. Thank you. [The statement of Mr. Cunningham follows:] [GRAPHIC] [TIFF OMITTED] T1270A.100 [GRAPHIC] [TIFF OMITTED] T1270A.101 [GRAPHIC] [TIFF OMITTED] T1270A.102 [GRAPHIC] [TIFF OMITTED] T1270A.103 [GRAPHIC] [TIFF OMITTED] T1270A.104 [GRAPHIC] [TIFF OMITTED] T1270A.105 [GRAPHIC] [TIFF OMITTED] T1270A.106 The Chairman. We hear your cry for help; namely, leave us alone, let us do it. I also want you to know that you are not the only one who has crowds of people yelling at him for a solution and offering no assistance. We experience that every day of the week. So you have our sympathy. Next, I am pleased to introduce, James Dickson, Vice President of Government Affairs for the American Association of People with Disabilities. He has been a very strong advocate throughout this process of making certain that anyone with disabilities is permitted to vote and has the sanctity of the secret ballot which is essential to all of us and essential to democracy. Mr. Dickson, you are recognized. STATEMENT OF JAMES DICKSON, VICE PRESIDENT OF GOVERNMENT AFFAIRS, AMERICAN ASSOCIATION OF PEOPLE WITH DISABILITIES Mr. Dickson. Thank you, Chairman Ehlers, members of the committee. I have two disabilities: I am blind and I am blunt. In these 5 minutes I am going to summarize some of the points of my written testimony. First I want to thank the Members of Congress who passed the Help America Vote Act. I voted secretly and independently for the first time 2 years ago; for the second time just a month ago. I cannotput into words the glorious feeling and the pride that I had as an American, and I am speaking for tens of millions of other Americans who have now the first opportunity to vote privately and independently. I have got a few stories to tell about the problems that I faced and which millions of other voters face when not being able to vote privately or independently. These happened to me, but literally there are millions of stories like it. The very first time I voted, the poll worker said to me, loud enough for everybody in the polling place to hear: You want to vote for who? On another occasion I had a poll worker say to me: We are very busy; nobody votes for state legislators and these other races, so how about if we finish now? On another occasion I had a poll worker say to me: These referenda today are really confusing, most people don't vote on them, so why don't we stop now? On yet another occasion I had a poll worker say to me: This print on the referenda is too small, I can't read it to you, so can we be finished? That particular excuse did not get much sympathy from me. Touch screens are the best existing product we have that offers accessibility to the greatest number of people. I participated in the earlier work that was referenced, by Kelly Pierce. The rest of the story is that after those initial tests, the company was able to inexpensively and quickly make changes to the access procedures so that the problems were eliminated. Touch screens--access is a continuum and we need to have equipment designed so that as access increases it can be cheaply, efficiently, and quickly installed on the equipment. Touch screens are the only product available now that meets those requirements. At AAPD we absolutely want secure, accurate, recountable elections that are systems that are accessible. The paper trail is not accessible. This is a California ballot. Try recounting. I will leave for the committee--this is the roll that was not able to be counted in Ohio. Paper trail is a Rube Goldberg contraption. It doesn't work, it is not accessible, you can't recount it. It doesn't even offer verification. Not only do people not look at the verification, in the tests done at the MIT where the computers were set up so that votes were changed, MIT students didn't find the changed vote when they looked at the verification on paper. When the verification was done by audio, listening through earphones, they found the changed votes. I want to sum up with the following three points. Things have to be accessible. Thank you for making that stand in HAVA. The paper trail does not even do what the proponents want, and the proponents are a very small group who speak very loudly. There have been, over and over again, public opinion polls. When voters use touch screens they trust them 80 percent; 80 percent when they use them. We shouldn't let a loud vocal minority using fear determine what is going to happen in the sanctity of the polling place. The last point I want to make, and it is very, very important, is the real problems in our voting system are human factors, are human errors. And before we order something to be done in the polling place, we need money to research and document what the problems are and we need to test proposed solutions in the reality of the polling place, not in a laboratory. Put me in an empty room with a ballot box full of paper, and I will hack into it in less than 60 seconds. Thank you again. This discussion is very important. And I would just ask you to remember that 80 percent of Americans who vote on touch screens believe their vote is secure and accurate. The Chairman. Thank you, Mr. Dickson. Appreciate your comments. Thank you, Mr. Dickson, and we appreciate your comments about showing why it was so worthwhile for us to insist that all individuals be able to cast their ballot in secret. So thank you. Next I am pleased to introduce Michael Shamos. He is a professor at Carnegie Mellon University and is also the director of the Institute for Software Research. Dr. Shamos, you are recognized. STATEMENT OF MICHAEL I. SHAMOS, PROFESSOR, INSTITUTE FOR SOFTWARE RESEARCH DIRECTOR, CARNEGIE MELLON UNIVERSITY Mr. Shamos. Thank you, Mr. Chairman. I just want to make a small correction to the record. I am not the director of the Institute for Software Research, I am just a member of the Institute for Software Research. But I am also an attorney admitted to practice in Pennsylvania and before the United States Patent Trademark Office. Since 1980 I have been an examiner of electronic voting systems for various States. I am currently an examiner for Pennsylvania and I have personally performed 118 voting systems examinations. I am going to do my 119th examination next week. I recall that, Mr. Chairman, you are a physicist, Representative Holt is a physicist. I am a former physicist. My proposal is we settle this issue like physicists, based on scientific evidence and not on emotion. I view electronic voting as primarily an engineering problem that includes the design of processes and procedures. Once the requirements for a voting system are agreed upon, it is then a matter of developing and manufacturing the equipment processes that meet these requirements. The question is whether Congress should be setting technical performance guidelines and engineering standards, as H.R. 550 would have it do, or whether such guidelines should be left to this and the EAC, as HAVA has already provided. The proposed bill is based on three major assumptions, all of which are false. First, it assumes that paper records are somehow more secure than electronic ones, a proposition that has been repeatedly shown to be wrong throughout history. Second, it assumes that voting machines without voter-verified paper trails are unauditable because they are claimed to be paperless, which is also false; they are neither paperless nor unauditable. Third, it assumes that paper trails actually solve the problems exhibited by DRE machines, which is likewise incorrect. The reason that mechanical voting machines were introduced over a century ago was to stop rampant fraudinvolving paper ballots. H.R. 550 would restore us to the year 1890 when anyone who wanted to tamper with an election needed to do no more than to manipulate pieces of paper. The recent example in Cleveland, Ohio, Cuyahoga County, is extremely instructive. That was the case we just heard, that 10 percent of the paper trails could not be read. H.R. 550 provides that in the event of any inconsistency between electronic and paper records, the paper records are irrebuttably presumed to be correct. Attorneys like myself are always wary of irrebuttable presumptions. Applying that provision to Cleveland would have resulted in the disenfranchisement of 10 percent of the electorate because their paper records could not be read. I cannot believe that the numerous sponsors of this legislation contemplated such an outcome. I did a review of the U.S. elections starting in the year 1824 when the popular vote began to be kept. I looked at the percentage of times that you took 10 percent of the popular vote and subtracted it from the winner and gave it to the loser, how often would the outcome change; and the answer is, since 1854, 55 percent of our Presidential elections would have been reversed if you couldn't count 10 percent of the paper trail. The argument is made that security problems with DRE voting demand remediation of the type proposed in the bill. Indeed Professor Felten at Princeton, Harri Hursti, and others have done a great service by exposing security vulnerabilities in voting systems. Some of these vulnerabilities are severe and require immediate repair, but the point is that they are easily remedied. The question for the committee is what the proper response to such discoveries ought to be. When tainted spinach was found in California, Congress did not ban the eating or distribution of leafy vegetables, even though at least one human life had been lost. The appropriate reaction to the discovery of a security flaw in a voting system is to repair it, not to outlaw an entire category of voting machines with which we have a quarter-century of experience. It is claimed that observed reliability problems with DRE machines will be alleviated by adding a paper trail. Field experience has shown the opposite. The failure rate of paper- trail DREs is double that of DREs without paper trails. It should be obvious that adding a new device with moving mechanical parts to an existing electronic machine cannot improve its reliability. The effect of H.R. 550 would be to ban electronic voting entirely in Federal elections. I want to repeat that. It would be to ban electronic voting entirely in Federal elections. The reason is that the bill sets forth conditions that are not met by any DRE system currently on the market in the United States. If it were to pass in its present form there could be no more electronic voting in this country, and Congress would be in the position, after spending $3 billion on new voting equipment, of spending billions more paying for what it just paid for. I cannot believe that the numerous sponsors of this legislation contemplated such on outcome. Further, the bill as written mandates a system that would violate constitutional and statutory provisions in more than half the States. The secret ballot is regarded as an essential component of American democracy. Each one of the DRE paper- trail systems that are currently on the market either enables voters to sell their votes or allows the government and the public to discover precisely how each voter in a jurisdiction has voted. I cannot believe that the numerous sponsors of this legislation contemplated that outcome either. I am in favor of voter verification. The proposed bill, despite incorporating the phrase ``voter verified'' into its title, does not come close to providing real voter verification. While it shows the voter that her choices were properly understood and recorded by the machine, it offers no assurance whatsoever that her ballot was counted, that it ever will be counted, or it will even be present in the event a recount is demanded. Once the polls have closed, the voter not only has no recourse or remedy, but is powerless to even determine whether her vote is part of the final tally or object, if she believes it isn't. That is not voter verification, regardless how it may be denominated in the text of the bill. I submit that if Congress desires to enact a comprehensive statute mandating voter verification, it ought to verify whether the proposed legislation actually accomplishes that goal. Numerous effective verification methods are known that are not based on vulnerable paper records. These have not yet been implemented in viable commercial systems. I understand that scientists at NIST will soon announce another one. If H.R. 550 is enacted there would be no point in continuing research and development on any such system, since the statute would prohibit any system that didn't use paper records. Professor Ronald Rivest of MIT has recently invented a voting method that allows each voter to verify, after the election is over, that her vote has actually been counted, a feature that is absent from the systems contemplated by H.R. 550. Professor Rivest's system also allows any member of the public to tabulate the results of the election for herself, so it is not even necessary to trust the official count. These discoveries demonstrate that voter verification is now a ripe area of scientific research and it is far too early to mandate by statute a bad nonsolution to a presumed problem. My purpose here today is not simply to complain about the bill but to offer a constructive alternative. As part of my written testimony, I have included a complete markup for the proposed legislation that retains its essential positive feature such as voter verification but eliminates its ill- advised provisions. I urge the committee not to report the bill favorably in its present form, and I thank you for the opportunity to be here today. The Chairman. Thank you for your testimony. [The statement of Mr. Shamos follows:] [GRAPHIC] [TIFF OMITTED] T1270A.107 [GRAPHIC] [TIFF OMITTED] T1270A.108 [GRAPHIC] [TIFF OMITTED] T1270A.109 [GRAPHIC] [TIFF OMITTED] T1270A.110 [GRAPHIC] [TIFF OMITTED] T1270A.111 [GRAPHIC] [TIFF OMITTED] T1270A.112 [GRAPHIC] [TIFF OMITTED] T1270A.113 [GRAPHIC] [TIFF OMITTED] T1270A.114 [GRAPHIC] [TIFF OMITTED] T1270A.115 [GRAPHIC] [TIFF OMITTED] T1270A.116 [GRAPHIC] [TIFF OMITTED] T1270A.117 [GRAPHIC] [TIFF OMITTED] T1270A.118 [GRAPHIC] [TIFF OMITTED] T1270A.119 [GRAPHIC] [TIFF OMITTED] T1270A.120 [GRAPHIC] [TIFF OMITTED] T1270A.121 [GRAPHIC] [TIFF OMITTED] T1270A.122 [GRAPHIC] [TIFF OMITTED] T1270A.123 [GRAPHIC] [TIFF OMITTED] T1270A.124 [GRAPHIC] [TIFF OMITTED] T1270A.125 The Chairman. We will now turn to questions from the committee, and I will begin and yield myself 5 minutes for that purpose. And Dr. Shamos, since we just finished with you, let me pursue one comment you made. I could pursue many, and I am sure others will pursue those, but on the one you said paper trails are no more accurate than any other method. Let me ask if you would also include paper ballots which are then read by a computer in that category. Mr. Shamos. Oh, Mr. Chairman, I don't think I actually made any comment about the accuracy of voting systems. I think I said that paper systems weren't secure. As far as accuracy, accuracy is a very poorly defined concept in voting systems and extremely difficult to measure, because we need to know in advance the voter's intent before they go into the voting booth. Then we need to see through the entire chain of custody of all the ballots at the end whether the final tally really reflects how the voters intended to vote. That is nearly unmeasurable except in small laboratory experiments. So I actually haven't made a comment about accuracy. The Chairman. Okay. In general, your comments about paper trails, do those also apply to paper ballots that are then scanned electronically? Mr. Shamos. Paper ballots that are scanned electronically are certainly subject to the same kinds of tampering. In fact it is easier in general to tamper with those because they are cut sheet paper, individual pieces of paper. There are all sorts of problems with optical scan voting but it is certainly acceptable as a method of voting. We use it in Pennsylvania. It is in widespread use around the country. The Chairman. Let me just extend that one little bit. In terms of recounting for--in case someone demands a recount, isn't a paper ballot a good reliable method of recounting, simply because the voters themselves have marked that particular piece of paper? Mr. Shamos. No. The problem is that once the voter has marked the ballot and verified that the ballot is marked the way she wants, she has no assurance that by the time the recount occurs, that same piece of paper is going to be in the hands of the recounters. Ms. Lofgren from Silicon Valley might recall that in the 2004 election in San Francisco, 3 weeks after the election, ballot boxes were found floating in San Francisco Bay with ballots in them. And so we have not solved the problem, security of paper ballots, in a widely distributed voting system that we have in the United States, with a couple hundred thousand precincts. The Chairman. Thank you. I didn't realize we had that problem since the LBJ election and Tammany Hall, Prendergast, et cetera. Thank you. And quickly I am turning to Mr. Felten, I am interested in your comments. How easily could one access the voting machine and insert a virus of the type you have commented? How long does it take to actually get the virus in place? Would someone need to access the machine for an appreciable amount of time? Or is this something that a voter in a voting booth could do? Mr. Felten. It takes about 1 minute of access to the machine, and I can show you roughly what would be involved. It would involve opening the door on the side of the machine, which would require getting a key. As I said, those are for sale on the Internet. There may be some security tape that would need to be removed and might be missing already. Opening up this door, putting in the memory card like this into the side of the machine--the memory card would have been prepared in advance with the computer virus on it--then pressing the red power button and waiting about 30 seconds, and afterward closing everything up and putting it back. This is something that would be unlikely to be doable by a voter in the polling place, but if the machine is not--if the machine is not guarded with a very careful chain of custody throughout its life cycle, it can be available to that. In my polling place in Princeton, the DRE machines sit unattended overnight, the night before the election, in an unlocked school lobby. The Chairman. How long would it take someone who had access to the machine to figure out how to write the program? Mr. Felten. It requires some information about how the machine works. This is not a Manhattan Project. It requires a moderate level of skill in computer programming and some limited knowledge, probably the knowledge that has in this case--that had leaked from the vendor to the Internet a few years ago, would be nearly enough. And I think an unscrupulous person would not have a problem getting the necessary information. The Chairman. So from the time you started looking at the machine until you devised the virus, what sort of time was involved? Mr. Felten. We got the machine in May. At first we spent a lot of time taking it apart to understand everything we could about how it worked. We were interested not only in whether a virus would be possible, but we really wanted to understand all of the security mechanisms and we wanted to treat it very carefully. From the time we started developing virus code until we had a working virus, perhaps a few weeks. The Chairman. Thank you very much. My time has expired. I am pleased to recognize my Ranking Member, the gentlelady from California. Ms. Millender-McDonald. Thank you so much, Mr. Chairman, and thank you again for this very interesting hearing. The one thing I want to say about my friends in the Senate, they have a bill out now, saying that every polling place should have a large supply of emergency paper ballots that can be used in emergency situations. That is just where we are. That is what we think about voting now in this country of ours. And so Senator Dodd and Senator Boxer and others have submitted this bill. But I have said all along that there is a security issue here. There is a trust issue that we must come to bear in terms of voters. Mr. Felten spoke about when there aren't consequences, there are compromises--or consequences bring compromises. And I wanted him to expound a little bit on that. And he also said that existing election procedures are not adequate for elections. I want you to expound on that too, sir. And tell me, if Mr. Dickson feels a paper trail is not adequate, especially for disability, then you are suggesting, Mr. Felten, that paper trails do cut down on voter fraud. So we have some imbalance here. If you could just speak to that for me on those issues. Mr. Felten. Certainly. The first issue had to do with thethe consequences of the compromise being worse in an electronic system. And in the example that we gave here, there is a computer virus that will spread itself from one voting machine to others, and the consequence is that if someone is able to compromise one machine, the virus can spread to many machines and potentially affect all the votes on all of those machines, as compared to fraud with an old-fashioned ballot box where access to a ballot box only allows someone to tamper with the votes that are in that ballot box, or maybe increase them by some amount. Access to one cannot involve stealing tens of thousands of votes as with an electronic system. Ms. Millender-McDonald. But this virus, you say, can pass from one machine or one voter to another. I think you stated that. How can that be when I am told manufacturers do not give out this so-called code, secure code they use, how can that then be done with that? Mr. Felten. Well, the way that the virus--the way that this virus spreads is on these memory cards. The memory cards are programmed before an election, usually at a central location, and they are programmed with the list of races and the list of candidates and so on for that election. Then they are distributed out to the polling places and put into the voting machines. That is a possible--that is a possible mode of travel of the virus. If the virus gets onto the memory card at that central location, it will then be installed out into the voting machine. After the election, the memory cards go in the opposite direction to carry the votes back to the county clerk or Board of Elections Office to tabulate them, and that allows the virus to go in the other direction. So a virus in one machine may hitch a ride on a memory card, after the election, back to the election headquarters and then potentially spread there onto many other cards that are then distributed, say, for the next election. This is much like the process by which older computer viruses spread on floppy disks. If you put an infected floppy disk into your PC, your PC would catch the virus and then it would spread to any other disk that you put into your machine. So it hitches a ride, opportunistically, on top of the flow of these memory cards that happens in running an election normally. Ms. Millender-McDonald. How do we answer Mr. Dickson's whole notion that paper trails are not acceptable to the disabled and yet you say cut down on voter fraud? Mr. Felten. Yes, I do believe it cuts down on voter fraud and I do believe that a paper trail, well designed, can be just as accessible. Mr. Dickson held up the roll of paper and pointed out he could not view that or verify it or audit it. But the DRE system that he is advocating stores his votes on this, which neither he nor anyone else can simply look at and read. The problem with these DREs and the security problem is exactly the thing that Mr. Dickson is complaining about: the inability of any voter to look at the machine and see their vote recorded. So I don't believe that there is a conflict between the use of a paper trail and accessibility. Ms. Millender-McDonald. There are just so many questions that I have just put all over the place here. The whole notion, Mr. Cunningham, that you spoke of--and I see my red light is on already. That is what I am saying, it is just so much in so little time to talk. The Chairman. We will have a second round. Ms. Millender-McDonald. A second to go back? The Chairman. Second round. Ms. Millender-McDonald. My second round I will come back to you, Mr. Cunningham and Mr. Shamos, because I do want to talk with you. Thank you, Mr. Chairman. The Chairman. Thank you. The Chair recognizes Mr. Brady, the gentleman from Pennsylvania, for 5 minutes. Mr. Brady. Thank you, Mr. Chairman. Mr. Chairman, I have a point of inquiry. Will Mr. Holt have a chance to speak? Will he have a chance to speak? The Chairman. By unanimous consent, we will allow Mr. Holt to speak. Mr. Brady. Okay. I am just--I don't think voting is a science. I think it is a people person thing. I think it is--I think it is a human thing. And I think that anything we do here, no matter what it may be, can be attacked, can be hacked into, can be verified. Ballot boxes can be put in a river, could not be shown. But I think what we are trying to show is try to eliminate as best as possible all these things that can possibly go wrong. And I don't understand why a receipt-- because that is what I look at a paper ballot as a receipt-- why, when you vote and you get your receipt and you have that and you see what you voted for--and if you don't have that, then you could--if you don't have that, then you can allow some type of protest somewhere. If you have no receipt, you think you voted, you don't know. It is up to now whatever tabulation or whatever machine or mechanical or scientific tabulation happens. And I don't understand why it would be a problem for anybody having a receipt. Mr. Shamos, you heard my statement and you have inspected many times the voting machines, and from what I understand, you had said that a malicious hacker could easily make the same switch, allowing votes to be changed from one vote to thousands of votes. Then if that is the case, why are these--we think these systems aren't reliable and if that is the case, what would be the problem with a verified paper trail? If I want to vote and I want to vote for you, if I look at a paper and it says I didn't vote for you, I can lodge a complaint right there. If I walk out there with nothing, I don't know who I actually voted for. I am in the hands of that machine, a hacker or anybody who could probably get in to violate the voting process. I don't understand why this should be a problem. No matter what we do, there will still be a human factor somewhere, someplace, somehow. At least a voter has the confidence that he has or she has a piece of paper stating that, yes, I did vote; yes, this is who I voted for. And if there is a mistake, you may have a chance to rectify it right there. That is my point. I yield back the balance of my time. Thank you, Mr. Chairman. The Chairman. Any answers or any comments? Mr. Shamos. I can say something. It is certainly true that if a malicious hacker is able to gain access to a voting machine and replace the software that is in there in such a way that that change is not detected, then there are severe problems. And that is what I say, when we find security vulnerabilities, we have to find ways of plugging them. For example, the vulnerability discovered by Professor Felten's group at Princeton was known to us in Pennsylvania back in March, right before our May primary. And we were forced to make an emergency remediation in Pennsylvania to blunt the effects of that discovered vulnerability, becausewe wanted to be able to assure county election officials and voters that an intrusion of the kind that was demonstrated here today was not possible, or if it had happened, the effects of it would have been reversed and so we remediated that. We also instructed the vendor that the next time it comes back for a certification, it better have remediation of its own so that we don't have to impose administrative procedures to make sure that that vulnerability can't be exploited. So I am not minimizing the possibility that people are out there trying to hack things. My point is the response to the hack is not to throw the machines in the ocean and go back to what we were doing in 1890. If it is a technological problem, we have a technological solution. With respect to the receipt, a lot of people think of the word ``receipt'' as meaning something that the voter can take home with them and look at later at their leisure and show maybe at some later time to an election official and say, see, this is really how I voted. It is not legal to give receipts of that kind because you can't give a voter anything they can use to prove how they voted, since they could then sell their vote. So the receipts we are talking about, these voter-verified paper trail systems, the voter has a chance to view the receipt on the machine and then say yea or nay; yes, that truly represents my vote or not, and then when they leave the polling place, they don't have a piece of paper to take with them, and my point--the point that I made in my earlier testimony is that it is nice enough to show the voter that their vote was properly recorded. But, again, there is no assurance that at the time the votes are actually tallied later, or a recount was done, that that piece of paper is even around or hasn't been replaced by something else, and there are people who are working on the solution to that problem and we are not there yet. Mr. Brady. Mr. Chairman, if I can just answer, you are way out there. You are talking about after voting, you are talking about people manipulating receipts that they may or may not get. I mean, now you are becoming human factor after human factor after human factor, somebody is hell-bent on trying to rig an election. That is not what we are talking about. We are talking about voter confidence. That is what I am talking about. I am not talking about a receipt you take home and say, I want to change my vote or I made a mistake. Because people do make mistakes. If you make a mistake on the voting machine, you make a mistake. You can't rectify it after you validate it. But I am saying, as you are saying, look, this is who I voted for. This is what I wanted to do. Push the okay button, push the vote button, whatever, close the curtain, open the curtain. I don't think there is anything wrong with that. That is what I am saying. I don't think there is nothing wrong with our bill. Mr. Shamos. If I told you that mechanism could be used to discover how every voter in the precinct voted, that might change your mind. Mr. Brady. I learned that you people with this electronic scientific, you show me anything I ever did in my entire life. So that doesn't scare me. The Chairman. That might make for an interesting episode. Ms. Simons, quickly. Ms. Simons. I just wanted to comment briefly on this whole paper issue, because I think we are comparing apples and oranges. One of the basic issues is how well engineered these systems are. And somebody who was advocating for voter-verified paper trails early on, fore the machines were retrofitted--I have to say I was appalled by what the voting machine companies came out with. They are bad. I mean, Mr. Cunningham is right. Jim Dickson is right. The continuous rolls of thermal printed paper have privacy issues, as Michael Shamos says. But they are badly engineered. It is bad technology. There is no reason why paper has to be--why they have to be designed that way. They were the cheapest way to do it. That was why it was done that way. I mean, banks deal with paper all the time. They manage to count it. And I don't think they make many counting mistakes. Other countries vote on paper, and they don't have problems. We can do it, too, but we have to do it right. If you do it wrong, it will fail. The Chairman. And for the last quick word, Mr. Dickson. Mr. Dickson. Chairman Ehlers, I wanted to respond to your question about counting optical scan ballots by machines. We have a lot of experience in this country with that. When you have large numbers of ballots, hundreds of thousands, and you have got a close race, every time the optical scan ballots have been counted you get a different number. You get a different number. We do not have the technology to accurately count large pieces of paper. The Chairman. Right. Thank you very much. Next the Chair recognizes the gentlewoman from California, Ms. Lofgren, for 5 minutes. Ms. Lofgren. Thank you, Mr. Chairman. This is a very helpful hearing, and as I am listening, it seems to me that the point made by Ms. Simons needs to be emphasized: The fact that we have a dysfunctional roll doesn't mean that that is the only alternative available as an auditable trail. You know, I spent more years on the board of supervisors in Santa Clara County than I have so far in Congress, and in California, the counties are the repository of the registrar of voters, and in California the registrar of voters is acivil service position. It is very nerdish, I guess is the best word you could say, in Silicon Valley and very apolitical, and it wasn't really until I got on the board of supervisors that I realized--I guess I never really thought about it--that, you know, some of the votes get lost. People don't think about that, but we had the little punch cards for a long time and it would jam up the machines on election night, and some of the ones that got mangled didn't get caught. And it didn't ever--at a time when the country was less closely divided than it is today, nobody really noticed because elections weren't that close. But of course now we have close elections all the time, and we are paying more attention to it. And so I do think that we need to make sure--you can't have a perfect system, I suspect, but we need to have a system where people do not question the integrity of it. I remember going with a computer scientist in my district who really said this: Yes, you can make a mistake, I mean, you can take a ballot box and throw it out, but the difference with hacking a machine is it is not random, the direction in which those votes are going to be lost. And so I am very enticed by Mr. Holt's bill. I would know that in a standards setting, there has been discussion that this would eliminate the privacy of individuals. But on page 3, line 13, of his vote, it specifies that to comply with the act that would not be permissible. So I think, you know, part of what we do here in Congress is to set standards and laws that need to be met, just as NIST does from an engineering point of view. I am wondering, Mr. Felten, Mr. Shamos said something to the effect that you could verify other than by paper means. I don't want to misquote you or something; it was something to that effect. How would you do that with the virus that your lab created? How would you do a verification without--would there be a way? Mr. Felten. Well, I think that the idea of nonpaper verification is something that is not ready yet. It is an active area of research. Mr. Shamos referred to Professor Rivest's work, which, by the way, is an all-paper system. And that is an interesting proposal, but I would not want to trust an election to it tomorrow. I think that years from now we may be in the position to have effective and useable nonpaper-based systems, but I do not believe they are ready yet and I don't think we can afford to wait. Ms. Lofgren. Mr. Shamos, your testimony has been very interesting, and thank you for your advocacy and your work on assuring systems. One of the things that you suggested, that we needed to make sure that vulnerabilities are protected again-- and no one would disagree against that--but one of the things I learned in my prior life in local government was that elections, they are not chaotic but they are--they are chaotic. You have got, you know, PTA mothers and you have got volunteers, and there are schools, and it is really--I love election day, but it is not really tightly controlled and cannot be, because that is not the way Americans hold elections, unless we completely fund this and have full-time paid people. And I don't think we are moving in that direction. So how would we be able--even if we found this virus, I know from Silicon Valley, I mean there are a million ways to hack this stuff. Given the fact we have this chaotic system, we have smart hackers everywhere, how do you protect against those vulnerabilities in your judgment? Mr. Shamos. Okay. So there are several ways. One is that we are never going to achieve perfection, we are never going to locate all vulnerabilities that exist in systems because we don't know how clever people may be in the future to get around the protections that we have built in. But this is true not just in voting systems. In every kind of system that has ever been made, there are later discovered vulnerabilities. As I said in my testimony, I am in favor of voter verification. Voter verification is a way of assuring that if a vulnerablity has been exploited that we are going to know about it. I think you just asked about a potential nonpaper mechanism for verification. I will give you a very simple one that the TS unit over there has a touch screen that shows things to the voter. The voter is not positive, however, that the marks that she makes that are visible on the screen are actually getting recorded by the machine. So all we have to do is have a second screen, made by a different manufacturer, and we take an electrical wire and we get a copy of whatever is on the first screen to the second screen, and we attach a digital camera to that and we make a record of what the screen showed. And if the voter has any doubt it has been recorded correctly, she can press a button that says ``replay'' and it will show her her vote again on the screen. And that vote gets recorded on a CD or DVD and prevents it from being tampered with later. That is just a trivial example of a nonpaper verification mechanism. The second way of doing it is through something called parallel testing, which is used in at least 10 counties in California. It is going to be used in Massachusetts in November. It is used in several other States, where you sequester a machine or machines during the election, during the actual time of the election, and you have a team of people vote on them, simulating the way they vote, except they vote according to the predefined script so we know what the total should be at the end. Then at the close of polls, we close that machine and we see if the totals match. If they don't match, then we know that there is a rat somewhere, and we do a forensic examination to find out where the rat is. The Chairman. The gentlewoman's time has expired. I am pleased to recognize our guest, Representative Holt, for five minutes. Mr. Holt. I thank the Chairman and I am pleased to see that we are holding--that you are holding this hearing, and I welcome the opportunity to be with you. And I regret that the hearing is being held the day before our target adjournment for the year. But nevertheless, I think you have put together a good panel of witnesses. Let me just make two quick comments. One is, HAVA had the unanticipated effect of motivating jurisdictions to go out and buy devices for voting that are clear, simple, accessible, easy to use and totally unverifiable. And it may be that there are various future methods of verifying that are not yet thought of or not yet developed, but right now we have a method of verifying where each voter can verify her vote at the time of voting, and that is a paper trail. And I do think it can be made accessible for voters, for all voters. Mr. Shamos just described a rather Rube Goldberg-ish CD camera that was going to photograph another screen. Boy,paper record sounds a whole lot easier to me. But anyway, let me first go to Mr. Felten, Professor Felten. How detectable would the virus that you devised, or that someone might devise, be before, during, and after the election? And let me ask another question. I don't know whether you are familiar enough with the kind of chain of custody and other checklists that Mr. Smith puts his machines through. Do you think a virus could be implanted in a system that had the kinds of protections that Mr. Smith describes? Mr. Felten. First the question of how detectable this would be. There is a long-established cat-and-mouse game in the PC world between virus writers and antivirus companies, and the virus writers have proven very successful at making viruses that are quite difficult to find, especially in advance. And I would expect, or I suppose fear, that we would see the same phenomenon here. We did not try to make this virus as stealthy as we could. But I think that if someone used the same methods that are used in the PC world to make viruses hide, it would be very difficult indeed to find in advance. Preelection logic and accuracy testing as has been discussed here will not find the virus that we devised, because it simply checks whether the machine is in logic and accuracy testing mode or real election mode, and if it is in logic and accuracy testing mode, the virus simply lies low. So I think it might be quite difficult to find, and I certainly would not have confidence that if it were implanted it could be found. The second part of your question related to the procedures that Mr. Smith described, and I think those sorts of procedures are very valuable. They do help to close the gap, to close the window of vulnerability, but we also have to recognize that procedures are not perfect and are not always followed. Like any other part of our election system, there will be gaps, there will be errors. And I still worry, despite the best of procedures, that the window of vulnerability opens enough that a determined adversary can get through it. Mr. Holt. Thank you Mr. Shamos. Yes, Mr. Smith. If there will be another round of questions, I would be happy---- Mr. Smith. I would like to respond to that, because I think it really comes to the core of what we are trying to talk about. I have listened to the situation with regards--I am the only one here, by the way, who uses Diebolt TS units, and I am the only election director I guess on the panel that does. One of the things I have been listening to and have been concerned about is how this virus would spread. I am an engineer by background. I hold a double E degree so I have some kind of technical capability in that. First of all, if you took one and you corrupted this memory card--can I see your card? If you took and corrupted this memory card, and it is going to go into one machine, and that one machine in my county is probably going to vote between 100 and 150 votes, that's all that's going to be counted on it, the issue comes on this card supposedly then is it is going to be corrupted; okay, we will lose 100 votes. That is not good, but it is not like we are losing 50,000 votes that I have cast in the general election, in the last one in 2004. Now, this comes out, it goes back to the end of the process, as Mr. Felten has said, it is only going to corrupt one more machine. The machines are not interconnected. There is not a possibility of corrupting the 500 machines that I am going to put in place for the 2006 general election. That is, you know, an issue. It is a tactic; it is not going to happen. Now, there are a lot of other things that we do. I mean, we have a lot of security in place. We follow it. I am very anal about those types of things and I have talked to Mr. Felten about it, and I think that he believes in our county we have a good thing. The last thing is, I would like to respond to what Ms. Millender-McDonald said--and I think this is as important as anything--is that the confidence people have in our equipment is very important. I mean, I couldn't say anything more. We take--and after every election we hand out a response card, given out randomly to our people. We say, what do you think about the process? You want to have, whatever, and I have got in front of you--it is not a technical, you know, survey of the type, but there are 715 responses. You can see the names, you can see the precincts, you can see what the election was held for; in addition, you can see their comments. 99.5 percent of the people that responded to these things in my county said we did an excellent job. There was only two people, only two that requested a paper trail. So I think we are doing a good job in Forsyth County, Georgia. I think we are doing an excellent job in the entire State of Georgia and I think that we need to be--I don't want to say ``recognized'' for it, but hopefully--don't impose things on us which are going to make our job much harder to do. But I also will tell you that I agree with Mr. Felten with regards to having verification, but I believe that we do not need to eliminate the paper. Mr. Holt. My time has expired. I hope Mr. Felten will get a chance to reply, because on my visit to his laboratory it was my understanding that the method of spreading the virus is different than Mr. Smith seems to understand. The Chairman. Very quickly could you give a brief response? Mr. Felten. Sure. Well, without getting into a long technical debate, let me just say that when this memory card goes back to the central facility and is put into a so-called accumulator machine which adds up the votes, if that accumulator machine becomes infected it can then infect a very large number of other memory cards that are subsequently put into it, and it acts as a very serious carrier of the virus. The Chairman. Thank you. Just an announcement to my colleagues. I have received a note that votes are expected between 12:00 and 12:15. I would like to have a second round of questions. Let me suggest that each of us tries to limit ourselves to three minutes. And I will begin, and then recognize the minority leader or the ranking member. Mr. Doolittle presumably will be settled in by then and ready with his question. We were just talking to Mr. Smith and I was wondering, Mr. Smith, what kind of system did Georgia have before it adopted the electronic system? Why did they see the need to change to the current system, and what were some of the problems you experienced with the previous system? Basically, is the new system better than the previous one or not? Mr. Smith. Okay. I think I can respond to that. Fortunately I took over as director of elections prior to theintroduction of the DRE machines. We had at that point in time the punch card machines. By the way I would say the security level we had on the punch cards is pretty miserable, now that I have gone through and listened to all the technical dissertations that have gone on. Our punch card machines were monitored by a computer as well. That computer sat in a-- it was an IBM 386 or something like that. It sat in a closet that we kept, and in fact they downloaded software to it routinely, you know, over the telephone lines. I would say that was highly unsecure, and I was mortified at that when I saw it. The changes, the changes that we had, 6 months prior to the 2002 election, Diebolt machines were introduced into Georgia. We had 6 months in which to take this across the entire State, and I would say that the secretary of state and the Center for Election Systems from Kennesaw State University did an outstanding job. I tell you, I personally used to run major computer projects. I didn't think they could do it. They have done an outstanding job. We have continued to hold elections, and people are very pleased with them in our State. Are there problems? I think some of the things Ms. Millender-McDonald brought up with regards to training poll workers are very valid, and I appreciate the fact that she will continue to fund it. I would like to ask if she would fund the program also so it is part and parcel of a program that I have introduced, which is called Forsyth First Vote, but we also use high school students to do it. One-third of all my poll workers are students. We have changed the entire complexion of the people in our county. Maybe that is why we are running good elections, I don't know, but I have got poll workers that we turn away because we have a very good program, and I am very pleased with it. Thank you. The Chairman. Thank you very much. Briefly, Mr. Cunningham, you mentioned that you grew up in a small town in Ohio. I spent my high school years in an even smaller town, I am sure, known as Celeryville, Ohio; population, 200. I have a question for you about the VVPAT technology, the printing paper trail technology. It is relatively new. You have described the problems that you have encountered with that in Ohio. Do you believe improvements can be made to the VVPAT printer technology to make it more reliable, to capture true vote totals, to avoid the problems you have had; and then would the added complexity brought to the system always increase the likelihood of failure? Or do you think through sufficient research and study, we could make them more reliable? Mr. Cunningham. Thank you, Mr. Chairman. I have a personal motto: I never buy the first model of anything. I always let other people figure out what the problems are before I buy. I think the fact of the matter is, when the Help America Vote Act was passed, most of the touch-screen voting machines were, by and large, prototypes and rushed into manufacture. I am not taking any issue with any of the manufacturers, and I am not making a comment on the reliability of any of their machines. But I think what we have got on our hands here is the Model-T Ford. We are in the early stages. Now, can it be improved? Absolutely. I think throughout my comments I was very definite to say these machines as they currently sit are not reliable. My question back to you, though, in that regard is, who is going to pay to fix it? Because one of the problems we have right now is in the last 24 months, every election jurisdiction in this country has spent the $3 billion we spoke about earlier on new election equipment, and that is what is in place. So without somebody stepping forward to fund that enterprise, I don't know how we are going to improve them ourselves. And if I could, Ms. Lofgren, I liken running an election to throwing a package of BBs on your kitchen table, and while somebody is on each leg moving the table, you are trying to keep them all on the table all day long. That is my analogy of election day. The Chairman. Thank you for that discouraging analogy. Next I recognize the Ranking Member for five minutes. Ms. Millender-McDonald. Thank you, Mr. Chairman. And let me again thank you so much for this hearing. This has been just absolutely the most informative hearing, one of the great ones we have had. Mr. Cunningham, I thank you for saying that we all agree that some type of verification system is needed, and at least we have a consensus here for that. But you did speak of the fact that you are adamantly opposed to any program such as yours in your State which makes VVPAT the official ballot of record for recount? If I am not mistaken, Ohio lost 10,000 ballots. And what happen here, given that you were not able to recount because you can't reprint? Mr. Cunningham. In Ohio--what election are you talking about? Ms. Millender-McDonald. It was my understanding that there were 10,000 votes that were unable to be recounted because you were unable to reprint. Mr. Cunningham. You mean at the ESI? Ms. Millender-McDonald. Yes. Mr. Cunningham. Ten percent of the VVPATs counted, I forget what the numbers were exactly. I believe the statement that I made was that nearly 10 percent of the tapes were either destroyed, blank, missing, taped together or otherwise compromised in some way. I don't--I don't think that it would be correct mathematically to say it was 10 percent of the votes; but 10 percent of the VVPAT tapes, based on what we reviewed, had some kind of compromise that made it very difficult to ascertain what the real numbers were. Ms. Millender-McDonald. But you make a valid point that because of the VVPAT, one is unable to reprint; therefore voters will be unable to discern whether or not their vote counted in an election. Am I correct on that? Mr. Cunningham. I am sorry; repeat that? Ms. Millender-McDonald. Am I correct in saying that because VVPAT is the official ballot record for recount purposes, that if you should need a recount, you cannot go to a reprint to discern whether or not those votes---- Mr. Cunningham. Right. That is exactly right, Madam. I would submit to you that to reconcile and verify vote totals on an electronic machine, there are better ways to do it in more controlled environments than the election-day environment that I just mentioned. And it is--for instance, when the machine back in the office and other records that are stored in that machine can be printed and otherwise looked at electronically, you know, we work every day on this. Ms. Millender-McDonald. I am sure. Mr. Cunningham. We try--that is my job is to try toreconcile those numbers at the end of the day, but trying to maintain this contemporaneous record. And the current state that it is in, and I think we have--I am just saying it is never going to match. And it is only going to fuel this--this fire that voting systems don't work, and I think Ohio has set itself in a very very dangerous situation. If I may just go on with that, there has been a little talk here about we are only concerned with Federal elections. You know, the least frequent election I run is a Federal election. We need to be very careful that one of the problems that has occurred since the passage of HAVA was it put many State rules and regulations in conflict with the Federal law. Ms. Millender-McDonald. Absolutely. Mr. Cunningham. And what we ended up with was these rules apply in a Federal election and these rules apply in a local election. That is a terrible situation. We cannot operate this enterprise with two sets of standards. Ms. Millender-McDonald. I couldn't agree with you more. Mr. Cunningham. Please do not think in terms of only Federal elections because it is a very problematic proposition. Ms. Millender-McDonald. Because you know what, sir? In a given election, you have three different laws that you perhaps might have to implement. Mr. Cunningham. Could have. Ms. Millender-McDonald. Local, State and Federal. And you know, my hat is off to all of you local elected ones who have to balance between the trenches. It is just really problematic. Ms. Simons, I will let you close me down because I wanted to go to Mr. Shamos. But I just have a second here for you to comment. Ms. Simons. Yes. I wanted to remind the panel what happened in Carteret County, North Carolina--I believe it was in 2004-- where paperless DREs were used and over 4,000 votes were lost. There is a concern about being unable to reprint paper ballots or VVPATs. When you lose votes in a DRE where there is no paper, there is nothing you can do. And in fact there was a statewide election for agricultural commissioner, where the separation between the two candidates was such that the results could have been reversed by those missing votes. And it went to court. The State Board of Elections first tried to hold a vote in just the county. That was thrown out by the court. Then the Board of Elections attempted to hold a statewide vote. That was thrown out by the court because we had no laws to deal with what happens when DREs fail. Finally there were a number of people who submitted subpoenas or petitions saying they voted for one of the candidates; and based on those submissions, it looked like the judge was going to declare that candidate the winner. So the other candidate conceded, and so that was how the election was decided. This is not the way to hold elections in this country. This is a problem with DREs, paperless DREs. This was a case of a failure, but there are many other problems too. We haven't even touched upon security problems such as, for example, the risk of somebody malicious getting a job with the vendor or the delivery service and inserting malicious code. We know that all software is buggy. We don't know, for example, if elections have been wrongly recorded because of buggy software, forget malicious code. There are so many basic problems that we just have no way of verifying elections that were held on paperless voting machines--we cannot verify them at this point. The Chairman. The gentlewoman's time has expired. Ms. Millender-McDonald. This is why the average voter now is just so befuddled over elections. The Chairman. And most of us are average voters. I am pleased to recognize the gentleman from California, Mr. Doolittle, for five minutes. Mr. Doolittle. Thank you, Mr. Chairman. Ms. Simons, your written statement said, quote: Unless there is evidence that the VVPBs have been compromised, the paper ballots should be used to determine the election results. I wanted to ask, what sort of evidence of compromise were you referring to? Ms. Simons. Well, obviously, if you have the kind of mess that Mr. Cunningham talked about, that would raise a lot of concerns. I share his concern about that kind of technology being deployed. We need to have good engineering, we need to have high standards, and we have to hold vendors to high standards. Vendors should not be allowed to produce machines that can create this kind kind of mess. Mr. Doolittle. Well, they are machines and I notice that machines occasionally make messes. Ms. Simons. You know, sometimes you get what you pay for. You can buy printers that don't jam. You can buy printers that don't have privacy issues. This is not rocket science. These things exist now. These technologies exist now, and I think a question that we have to ask ourselves is how much are we willing to pay for our democracy, you know---- Mr. Doolittle. And our Republic. Ms. Simons. And our Republic; yes, thank you. Mr. Doolittle. Now I apologize, I should have been here, and I couldn't be here earlier, so I missed the direct testimony. But I think Mr. Cunningham is from Allen County, right? But there was an incident in Cuyahoga County where there was a problem. I just wondered if you could tell us, Ms. Simons, do you think this evidence of compromise was compromised in the Cuyahoga recount? Ms. Simons. Sir, that is what I was referring to, actually. Mr. Doolittle. Oh, all right. Do you think the paper trail should have been used as the official ballot in that case? Because that is kind of---- Ms. Simons. Well, in that case it is a problem. It is a real problem, just as the Carteret County failure is a real problem. We can see problems with the paperless systems and problems with the systems that have been retrofitted with VVPATs. The underlying issue, which I believe everyone on this panel would agree on, is we need to have well-engineered, well- designed, robust systems. As Mr. Cunningham said, this is sort of like the Model-T. These are first generations and they are failing. That is not good. Mr. Doolittle. Well, I understand the Model-T analogy, but I don't think the members of this committee and the Congress in general want to throw away hundreds of millions of dollars on the Model-T. Mr. Dickson, would you like to comment? Mr. Dickson. Yes. There were two points. The loss of votes is really, really, a terrible situation. Mr. Doolittle. Is what, sir? Mr. Dickson. The loss of any votes is really a terrible situation. Votes get lost on paper too. The Carteret County voting machine does not meet the current standards. If that county had purchased an accessible voting machine, built to the current standards, that problem would not have happened. Mr. Dickson. The Carteret machine, a little red light comes on with no words around, and it says, ``This machine is full.'' There was no explanation in the training for poll workers that said this red light means the machine is full. On the other machine, the machine reads, ``Screen full,'' and will not accept new votes. Mr. Doolittle. Sir, you said--when are you talking about-- are you talking about the one in Cuyahoga County? Mr. Dickson. Carteret County in North Carolina where votes were lost on a voting machine. That county administrator wanted to buy new accessible voting equipment, and the purchase of it was delayed because of the commotion about a paper trail. And the problem was created because of the delay. Mr. Doolittle. Well, I just wonder, in the Cuyahoga County case I understand that the paper trail, which I think Mr. Holt's bill is going to be the thing we go by if there is a conflict--in that case the paper trail lost nearly 10 percent of the votes, so it doesn't seem there would be real problems in that instance at least. Hopefully that would be relatively rare, but in that instance if we went by the paper trail, as the bill called for, there would be problems. Ms. Simons. Actually, there were many problems in that county.I understand there were problems with the DREs; that the redundant memories did not match in about 26 percent of the cases. So if you are going to try to do a verification using the redundant memories, there can be issues. There were a great many problems, not just involving the VVPATs. This just shows that we need to focus more on technology, on policies and procedures. As Mr. Cunningham said, running an election is a complicated thing, but just because there were problems involving one technology doesn't mean that that technology can't be implemented correctly. Banks deal with money and paper ballots all the time. Canada holds its Federal election with paper ballots, so does the U.K., and they manage. Mr. Doolittle. In this case the paper trail didn't solve the problem. Ms. Simons. Because it was badly engineered. Mr. Doolittle. The point is paper is not the ultimate solution. The Chairman. The gentleman's time is expired. Mr. Brady, you are recognized for 5 minutes. Mr. Brady. We are going through as I speak in my city and county in Philadelphia a write-in candidate, as you had, and we are doing that as we speak. We are in court now because the candidate on the machine won. Then they had a paper they could write on, and they are counting the write-in ballots, and that person won, and they are going to decide it in court. So we at least had the opportunity to do that. I heard you have ways of rectifying or double-checking votes by voting electronically and having a camera. A lot of people don't have good faith in any kind of electronics, and what we are trying to do here is the right thing. We are trying to restore confidence and, most important, trying to restore trust back into our process, and we are trying to figure out the best way to do that. I understand there is a financial problem, and I understand there is always a financial issue, but like what you said, there is never enough money. You can always find some money to assure democracy, and I subscribe to that. Thank you, Mr. Chairman. The Chairman. Thank you. The Chair recognizes the gentlewoman from California Ms. Lofgren for five minutes. Ms. Lofgren. Thank you, Mr. Chairman. At the conclusion of my first set of questions, Mr. Shamos had described alternative ways to verify the vote. I am wondering if, Mr. Felten, do you have a comment on those proposals, and also Ms. Simons? Mr. Felten. If I recall correctly, he mentioned two mechanisms, one involving a second screen and a video camera. This seems to me more complicated, more expensive than a paper- based verification system and probably not any more trustworthy. He also mentioned parallel testing, which involves taking the machine aside and holding a simulated election. This is something we discussed in some detail in our research paper, and the bottom line is that that is a worthwhile mechanism, but it is not completely effective, not 100 percent effective at the problem. It raises the bar, makes it more difficult to make a virus, for example, that will evade detection. We should do it, but we should not believe that it is going to entirely fix the problem. Ms. Simon. To pick up on Ed's comments, the alternative device that Professor Shamos mentioned makes it very difficult to hold a recount. If you want to have public confidence in elections, one way in which you do that is by audits and recounts. I don't know how you would audit that screen. It seems to me it would have the same problems as these long rolls of paper that Mr. Cunningham showed you, someone to sit in front and say, this one voted here, and this one voted there. Ms. Lofgren. Mr. Smith, do you have a comment on it? I cut you off, Barbara. I didn't mean to. Ms. Simons. May I finish? The best way to count things is the way you count money, you sort it into piles, and you count each pile, and that can be transparently and with a TV camera watching a count as a way in getting confidence in the results. Regarding parallel testing, I think we agree parallel testing is a good thing to do. But there is a big ``what if,'' and that ``what if'' is: What if you find a problem with the parallel testing? Are you going to go back and rerun the election? As we saw in Carteret County, that raises enormous legal and technical problems. Ms. Lofgren. Mr. Smith. Mr. Smith. I would like to speak from the complexity of the operation that you are trying to bring about. One of the things we have got in Georgia is a more simple format, I think, for running the election because we do not have voter-verifiable paper trail. One of the issues--I was actually charged with running the manual recount, so I have some experience with that, too. I wanted to see it being done because it is being talked about in our State. One of the concerns I have, and I think we all should look back to, is who are the people putting this stuff into operation on election day? It is typical. We have done things, you see it. We have part-time people who are volunteers who really try to do things, but they have gotten up at 4:00 in the morning, 5:00 in the morning. They have to open the machines up, do all the other things. In Ohio with the VVPAT for Cuyahoga County, they had to do other things that we didn't have to do. They go through the logic and accuracy testing essentially right there. They enter the machines, they start them up, they do everything. They bring the memory cards. Part of the problem was the memory cards weren't seated properly. That was a problem. But the other thing is they had to be responsible for these printers. In some cases they put the paper in backwards. Ms. Lofgren. Let me explore that, because I am taking as a given that we are not going to completely change the way America holds elections, I think that is true. And I can remember voting when I was still at my parents' house, and you go down to the corner, and Mrs. Lucky, who always ran it, and it is retirees and people that volunteer, and it is a wonderful thing, but that is the given. A lot of States have these verifiable systems, California among them. Ms. Simons, has any of them come up with a system that actually works better than that silly tape that we have seen? Ms. Simons. I think precinct-based optical scan systems are excellent. That gives the voter a chance to check for overvotes and the absence votes. You put your ballot through the scanner, and it tells you if there is a problem with it. Recounts and audits are relatively easy. The voter verifies the ballot by definition, because the voter can look at it. There are ways for blind voters to verify an optical scanballot. One possibility is the use of a hand-held device that reads the ballot for a blind voter. We know that this technology exists. Another is to allow blind voters to use tactile ballots where they insert the blank ballot into a sleeve envelope that is marked. The sleeve has holes that allow a blind voter to mark the ballots. There is also a system being marketed which allows a blind voter to verify his or her ballot with a vibrating device. Ms. Lofgren. I see my time has expired, but I would just like to note that I think we may have in the future some other way to verify, but I just ask Mr. Holt to put me on his bill because I think we need to have some in between on this. [Applause.] The Chairman. No demonstrations. I am now pleased to recognize Mr. Holt for five minutes. Mr. Holt. Thank you, Mr. Chairman. My questioning will be along a couple of lines. First of all, Mr. Shamos, I am sorry I didn't have the exact transcript here, but said something or other you hate to see us outlaw an entire category of machines. This legislation doesn't outlaw any particular kind of voting system except unverifiable ones. And you said further, I think, that scare tactics by a minority, you hate to see that disrupt the whole process. The Brennan Center for Justice of New York University Law School conducted a study with very distinguished people, Ron Rivest from MIT, Howard Schmidt, an administration and corporate security expert, and a number of others; and said it found, quote, all three major types of voting systems have significant security and reliability vulnerabilities that pose a real danger to the integrity of national, State and local elections. The League of Women Voters, not a scary minority, says they support, quote, only voting systems that are designed so that they employ a voter-verifiable paper ballot or other paper record, said paper being the official record of the voter's intent. The report of the Carter-Baker Commission similarly called for a voter-verified paper record, random audits and so forth. Mr. Chairman, I would like to ask that the Brennan Center report, the statement of the National League of Women Voters and the Carter-Baker report be made a part of the record. The Chairman. Without objection, so ordered. Mr. Holt. Thank you. I want to make the point that a number of organizations, very responsible organizations with computer scientists involved and so forth, have taken a look at this matter, and we would do well to take a look at that. Ms. Simons, I would appreciate it if you would say a little bit more about ACM and the subcommittee that is looking at this. Then also what I would like the witnesses to comment on, as Mr. Dickson recounts and Mr. Smith and others, votes can be lost in a lot of ways. They can be lost through manipulating the registration list, intimidating voters. There are a lot of things that we need to address: Restricting accessibility at polling places or in the polling booth; memory cards may not be seated properly; we may not recognize that the memory is full before election day is over; and paper records, Mr. Doolittle, might be illegible or torn or otherwise difficult to use. But it has been determined at least as often that redundant electronic memories show that there are problems with purely electronic memory. So what I would like to ask of the witnesses is would you prefer to have a system where there is no possible way of recovering what happened, in other words, where the electronic vote, for whatever reason, a poorly seated memory card or something else, is wrong, and there is no possibleway of recovering it; or, as Ms. Simons points out, a well-designed system with a paper audit trail where there is at least a reasonable chance of being able to recapture, recover what the voters' intentions were? So I would be happy to have a quick comment from the witnesses, beginning with Ms. Simons. Ms. Simons. You asked me about ACM. It is an 80,000-member professional society of computer professionals. Like the APS, (the American Physical Society), the ACM is the premier computing society, I would say, in this country. The statement that I referred to, which is in my written testimony, was voted on by ACM Council, which is the elected policy making body of ACM. But they did something unusual, not typical for ACM. The statement was put on the Web site for members to vote on. Of those who voted, 95 percent supported the statement. Of the 5 percent who did not support the statement, roughly half, based on written comments, objected to the fact that it wasn't broad enough, that it didn't discuss usability issues as well. So I would say obviously you never get 100 percent agreement, but in this case we are pretty close to consensus, at least within ACM. The Chairman. The gentleman's time has expired. Make brief comments, please. Mr. Shamos, first. Mr. Shamos. I want to respond to a couple of things. I actually didn't make a comment about scare tactics, although I believe there was another member of the panel that did. I just said I don't think we should appeal to emotion on this issue. I agree that H.R. 550 does not expressly outlaw any particular type of voting equipment. My point was that the practical effect of it is that it outlaws DRE machines, and the reason it outlaws DRE machines is there is no current machine on the market that meets the requirement of the bill and that is usable in individual States along with their requirements. For example, in Pennsylvania there is popular call for a paper trail machine. Four vendors have come to Pennsylvania with their paper trail machine. Not a single one has been able to simultaneously offer a paper trail and meet Pennsylvania's statutory and constitutional requirements. So we can't have one even if we want one. The technology is just not there yet. The Chairman. I think Mr. Felten had a comment. Mr. Felten. The key issue, I think, is resiliency; things go wrong, people make mistakes, and we need to have a system we can trust even when things do go wrong. The combination of paper plus electronic record is more resilient than either one would be alone, and that, I think, is the strongest argument for having a paper-based verification system. Mr. Ehlers. I think Mr. Cunningham has the last answer. Mr. Cunningham. I just wanted to make the point to everybody that my experience is most votes are lost due to voter error, not machine error, not election official error. I don't know if you looked at my resume, but I have about 20 years in the printing business, and I have been around a lot of printing machines and copy machines, and I can assure you anything you put paper through will jam at some point in time. E-voting, I want to say to you, I truly believe that in the long-term interest of this country--we are still voting the same way we did 150 years ago, as you mentioned, Ms. Lofgren, down to your little poll at the corner and precinct. Our society has changed. It is mobile, moving. The ability to incorporate the vote centers as Scott Doyle in Colorado has been working with as a convenience to voters, those types of concepts are based on electronic voting. Let's not throw the baby out with the bath water here. I think, Mr. Brady, what is doing more damage to voter confidence, quite frankly, is people like your distinguished colleague Mr. Conyers publishing reports about the election in Ohio that are factless and baseless; none of the accusations have been proved. We have got to quit this. We have got to get this conversation back to an honest debate about, as I think the whole panel has said, how do we work together and move this thing forward and quit this sky is falling kind of thing. I think elections, because given the magnitude of them--and I have seen now 9 years' worth of them, two Presidential, couple of gubernatorials--given what could happen and the magnitude of the task, they are running pretty darn good in this country, and I know people all over the country like myself and Mr. Smith that are darn proud they are involved in it. And the net effect is we are going to begin to drive those people out of this, which is going to make the system more vulnerable than you ever imagined. Ms. Millender-McDonald. Mr. Cunningham, I sure hope that is accurate, what you have said, because the voter is not there yet. Even though you folks are and your experts, the voter is not there yet. And that is the ultimate one that we must bring trust, security to bear. I would like for you to get for me whatever documentation you have that suggests voter error is more than a paper error. If you have that type of verification of that statement you made, I would like to have it. Mr. Cunningham. My point was that most voting error is voter error. The Chairman. I thank you for your comments. That is a good wrap-up. We are going to have votes in just a few moments, and I would just like to make a few closing comments. First of all, I thank each and every one of you for being here in the audience as well as at the witness table. You have contributed immensely to this very important issue. There is our votes. I recognize very clearly, since I have served at the local level, the state legislature and now here, that the states have an important role, local governments have an important role, and the federal government has an important role. We often say here that the states are the experimental apparatus that tests ideas, and then the federal government should select from the best of what the states have discovered. We did not take the time to do that in HAVA, and I think that was a mistake. We also did not take the time to first set the standards clearly and then allow manufacturers to develop equipment to meet those standards. And I think that was a fatal flaw which has, I believe, created much of the uncertainty that we have. I agree totally with the statement someone made: Never buy the first model of anything. I bought the first model of one automobile just because it precisely fit my needs, it was a good manufacturer; a bad mistake, and I was franklyrelieved when the car eventually got totaled and I got the insurance value because I probably could never have sold it. We have to recognize that there is a lot of work to be done here yet, and the American public's confidence will return because we will build a better system. Finally, I want to comment that I always look at two aspects here. We want to assure every voter that their vote will be counted, be counted accurately, and that the system will work that way. There is a second factor we must remember, and that gets back to the viruses and other issues. We also have to assure every voter that not only will the vote be counted, but it will not be negated or diluted by other people voting fraudulently or performing fraudulent acts such as viruses, throwing ballot boxes away and so forth. I want to make sure every voter is assured of both of those--an accurate count of their vote and an assurance that no one else is going to negate it through illegal activity. So I am concentrating on those two not just in this particular issue, but in other issues such as the photo ID bill that we passed through the House a week ago, which I think will also help. Thank you very, very much. You have been an outstanding panel. I appreciate all that you have done. We do have to go vote, and I have a few things to read here. I ask unanimous consent that Members and witnesses have seven calendar days to submit material for the record, including additional questions of the witnesses, and for those statements and materials to be entered into the appropriate place in the record. And I assume if we send you written questions, you will respond to those. Without objection the material will be so entered. The Chairman. I ask unanimous consent that staff be authorized to make technical and conforming changes on all matters considered by the committee at today's hearing. Without objection, so ordered. Ms. Millender-McDonald. Ms. Millender-McDonald. I just wanted to concur with you. I have served on the local, State and Federal level, and I do think that we need to revisit HAVA because it was more or less geared for the Federal. And we appreciate all of those who have come today, those who serve on both the local, State and Federal. Thank you, Mr. Chairman. The Chairman. Thank you. Having completed our business for today and for this hearing, the committee is hereby adjourned. [Whereupon, at 12:23 p.m., the committee was adjourned.] [GRAPHIC] [TIFF OMITTED] T1270A.126 [GRAPHIC] [TIFF OMITTED] T1270A.127 [GRAPHIC] [TIFF OMITTED] T1270A.128 [GRAPHIC] [TIFF OMITTED] T1270A.129 [GRAPHIC] [TIFF OMITTED] T1270A.130 [GRAPHIC] [TIFF OMITTED] T1270A.131 [GRAPHIC] [TIFF OMITTED] T1270A.132 [GRAPHIC] [TIFF OMITTED] T1270A.133 [GRAPHIC] [TIFF OMITTED] T1270A.134 [GRAPHIC] [TIFF OMITTED] T1270A.135 [GRAPHIC] [TIFF OMITTED] T1270A.136 [GRAPHIC] [TIFF OMITTED] T1270A.137 [GRAPHIC] [TIFF OMITTED] T1270A.138 [GRAPHIC] [TIFF OMITTED] T1270A.139 [GRAPHIC] [TIFF OMITTED] T1270A.140 [GRAPHIC] [TIFF OMITTED] T1270A.141 [GRAPHIC] [TIFF OMITTED] T1270A.142 [GRAPHIC] [TIFF OMITTED] T1270A.143 [GRAPHIC] [TIFF OMITTED] T1270A.144 [GRAPHIC] [TIFF OMITTED] T1270A.145 [GRAPHIC] [TIFF OMITTED] T1270A.146 [GRAPHIC] [TIFF OMITTED] T1270A.147 [GRAPHIC] [TIFF OMITTED] T1270A.148 [GRAPHIC] [TIFF OMITTED] T1270A.149 [GRAPHIC] [TIFF OMITTED] T1270A.150 [GRAPHIC] [TIFF OMITTED] T1270A.151 [GRAPHIC] [TIFF OMITTED] T1270A.152 [GRAPHIC] [TIFF OMITTED] T1270A.153 [GRAPHIC] [TIFF OMITTED] T1270A.154 [GRAPHIC] [TIFF OMITTED] T1270A.155 [GRAPHIC] [TIFF OMITTED] T1270A.156 [GRAPHIC] [TIFF OMITTED] T1270A.157 [GRAPHIC] [TIFF OMITTED] T1270A.158 [GRAPHIC] [TIFF OMITTED] T1270A.159 [GRAPHIC] [TIFF OMITTED] T1270A.160 [GRAPHIC] [TIFF OMITTED] T1270A.161 [GRAPHIC] [TIFF OMITTED] T1270A.162 [GRAPHIC] [TIFF OMITTED] T1270A.163 [GRAPHIC] [TIFF OMITTED] T1270A.164 [GRAPHIC] [TIFF OMITTED] T1270A.165 [GRAPHIC] [TIFF OMITTED] T1270A.166 [GRAPHIC] [TIFF OMITTED] T1270A.167 [GRAPHIC] [TIFF OMITTED] T1270A.168 [GRAPHIC] [TIFF OMITTED] T1270A.169 [GRAPHIC] [TIFF OMITTED] T1270A.170 [GRAPHIC] [TIFF OMITTED] T1270A.171 [GRAPHIC] [TIFF OMITTED] T1270A.172 [GRAPHIC] [TIFF OMITTED] T1270A.173 [GRAPHIC] [TIFF OMITTED] T1270A.174 [GRAPHIC] [TIFF OMITTED] T1270A.175 [GRAPHIC] [TIFF OMITTED] T1270A.176 [GRAPHIC] [TIFF OMITTED] T1270A.177 [GRAPHIC] [TIFF OMITTED] T1270A.178 [GRAPHIC] [TIFF OMITTED] T1270A.179 [GRAPHIC] [TIFF OMITTED] T1270A.180 [GRAPHIC] [TIFF OMITTED] T1270A.181 [GRAPHIC] [TIFF OMITTED] T1270A.182 [GRAPHIC] [TIFF OMITTED] T1270A.183 [GRAPHIC] [TIFF OMITTED] T1270A.184 [GRAPHIC] [TIFF OMITTED] T1270A.185 [GRAPHIC] [TIFF OMITTED] T1270A.186 [GRAPHIC] [TIFF OMITTED] T1270A.187 [GRAPHIC] [TIFF OMITTED] T1270A.188 [GRAPHIC] [TIFF OMITTED] T1270A.189 [GRAPHIC] [TIFF OMITTED] T1270A.190 [GRAPHIC] [TIFF OMITTED] T1270A.191 [GRAPHIC] [TIFF OMITTED] T1270A.192 [GRAPHIC] [TIFF OMITTED] T1270A.193 [GRAPHIC] [TIFF OMITTED] T1270A.194 [GRAPHIC] [TIFF OMITTED] T1270A.195 [GRAPHIC] [TIFF OMITTED] T1270A.196 [GRAPHIC] [TIFF OMITTED] T1270A.197 [GRAPHIC] [TIFF OMITTED] T1270A.198 [GRAPHIC] [TIFF OMITTED] T1270A.199 [GRAPHIC] [TIFF OMITTED] T1270A.200 [GRAPHIC] [TIFF OMITTED] T1270A.201 [GRAPHIC] [TIFF OMITTED] T1270A.202 [GRAPHIC] [TIFF OMITTED] T1270A.203 [GRAPHIC] [TIFF OMITTED] T1270A.204 [GRAPHIC] [TIFF OMITTED] T1270A.205 [GRAPHIC] [TIFF OMITTED] T1270A.206 [GRAPHIC] [TIFF OMITTED] T1270A.207 [GRAPHIC] [TIFF OMITTED] T1270A.208 [GRAPHIC] [TIFF OMITTED] T1270A.209 [GRAPHIC] [TIFF OMITTED] T1270A.210 [GRAPHIC] [TIFF OMITTED] T1270A.211 [GRAPHIC] [TIFF OMITTED] T1270A.212 [GRAPHIC] [TIFF OMITTED] T1270A.213 [GRAPHIC] [TIFF OMITTED] T1270A.214 [GRAPHIC] [TIFF OMITTED] T1270A.215 [GRAPHIC] [TIFF OMITTED] T1270A.216 [GRAPHIC] [TIFF OMITTED] T1270A.217 [GRAPHIC] [TIFF OMITTED] T1270A.218 [GRAPHIC] [TIFF OMITTED] T1270A.219 [GRAPHIC] [TIFF OMITTED] T1270A.220 [GRAPHIC] [TIFF OMITTED] T1270A.221 [GRAPHIC] [TIFF OMITTED] T1270A.222 [GRAPHIC] [TIFF OMITTED] T1270A.223 [GRAPHIC] [TIFF OMITTED] T1270A.224 [GRAPHIC] [TIFF OMITTED] T1270A.225 [GRAPHIC] [TIFF OMITTED] T1270A.226 [GRAPHIC] [TIFF OMITTED] T1270A.227 [GRAPHIC] [TIFF OMITTED] T1270A.228 [GRAPHIC] [TIFF OMITTED] T1270A.229 [GRAPHIC] [TIFF OMITTED] T1270A.230 [GRAPHIC] [TIFF OMITTED] T1270A.231 [GRAPHIC] [TIFF OMITTED] T1270A.232 [GRAPHIC] [TIFF OMITTED] T1270A.233 [GRAPHIC] [TIFF OMITTED] T1270A.234 [GRAPHIC] [TIFF OMITTED] T1270A.235 [GRAPHIC] [TIFF OMITTED] T1270A.236 [GRAPHIC] [TIFF OMITTED] T1270A.237 [GRAPHIC] [TIFF OMITTED] T1270A.238 [GRAPHIC] [TIFF OMITTED] T1270A.239 [GRAPHIC] [TIFF OMITTED] T1270A.240 [GRAPHIC] [TIFF OMITTED] T1270A.241 [GRAPHIC] [TIFF OMITTED] T1270A.242 [GRAPHIC] [TIFF OMITTED] T1270A.243 [GRAPHIC] [TIFF OMITTED] T1270A.244 [GRAPHIC] [TIFF OMITTED] T1270A.245 [GRAPHIC] [TIFF OMITTED] T1270A.246 [GRAPHIC] [TIFF OMITTED] T1270A.247 [GRAPHIC] [TIFF OMITTED] T1270A.248 [GRAPHIC] [TIFF OMITTED] T1270A.249 [GRAPHIC] [TIFF OMITTED] T1270A.250 [GRAPHIC] [TIFF OMITTED] T1270A.251 [GRAPHIC] [TIFF OMITTED] T1270A.252 [GRAPHIC] [TIFF OMITTED] T1270A.253 [GRAPHIC] [TIFF OMITTED] T1270A.254 [GRAPHIC] [TIFF OMITTED] T1270A.255 [GRAPHIC] [TIFF OMITTED] T1270A.256 [GRAPHIC] [TIFF OMITTED] T1270A.257 [GRAPHIC] [TIFF OMITTED] T1270A.258 [GRAPHIC] [TIFF OMITTED] T1270A.259 [GRAPHIC] [TIFF OMITTED] T1270A.260 [GRAPHIC] [TIFF OMITTED] T1270A.261 [GRAPHIC] [TIFF OMITTED] T1270A.262 [GRAPHIC] [TIFF OMITTED] T1270A.263 [GRAPHIC] [TIFF OMITTED] T1270A.264 [GRAPHIC] [TIFF OMITTED] T1270A.265 [GRAPHIC] [TIFF OMITTED] T1270A.266 [GRAPHIC] [TIFF OMITTED] T1270A.267 [GRAPHIC] [TIFF OMITTED] T1270A.268 [GRAPHIC] [TIFF OMITTED] T1270A.269 [GRAPHIC] [TIFF OMITTED] T1270A.270 [GRAPHIC] [TIFF OMITTED] T1270A.271 [GRAPHIC] [TIFF OMITTED] T1270A.272 [GRAPHIC] [TIFF OMITTED] T1270A.273 [GRAPHIC] [TIFF OMITTED] T1270A.274 [GRAPHIC] [TIFF OMITTED] T1270A.275 [GRAPHIC] [TIFF OMITTED] T1270A.276 [GRAPHIC] [TIFF OMITTED] T1270A.277 [GRAPHIC] [TIFF OMITTED] T1270A.278 [GRAPHIC] [TIFF OMITTED] T1270A.279 [GRAPHIC] [TIFF OMITTED] T1270A.280 [GRAPHIC] [TIFF OMITTED] T1270A.281 [GRAPHIC] [TIFF OMITTED] T1270A.282 [GRAPHIC] [TIFF OMITTED] T1270A.283 [GRAPHIC] [TIFF OMITTED] T1270A.284 [GRAPHIC] [TIFF OMITTED] T1270A.285 [GRAPHIC] [TIFF OMITTED] T1270A.286 [GRAPHIC] [TIFF OMITTED] T1270A.287 [GRAPHIC] [TIFF OMITTED] T1270A.288 [GRAPHIC] [TIFF OMITTED] T1270A.289 [GRAPHIC] [TIFF OMITTED] T1270A.290 [GRAPHIC] [TIFF OMITTED] T1270A.291 [GRAPHIC] [TIFF OMITTED] T1270A.292 [GRAPHIC] [TIFF OMITTED] T1270A.293 [GRAPHIC] [TIFF OMITTED] T1270A.294 [GRAPHIC] [TIFF OMITTED] T1270A.295 [GRAPHIC] [TIFF OMITTED] T1270A.296 [GRAPHIC] [TIFF OMITTED] T1270A.297 [GRAPHIC] [TIFF OMITTED] T1270A.298 [GRAPHIC] [TIFF OMITTED] T1270A.299 [GRAPHIC] [TIFF OMITTED] T1270A.300 [GRAPHIC] [TIFF OMITTED] T1270A.301 [GRAPHIC] [TIFF OMITTED] T1270A.302 [GRAPHIC] [TIFF OMITTED] T1270A.303 [GRAPHIC] [TIFF OMITTED] T1270A.304 [GRAPHIC] [TIFF OMITTED] T1270A.305 [GRAPHIC] [TIFF OMITTED] T1270A.306 [GRAPHIC] [TIFF OMITTED] T1270A.307 [GRAPHIC] [TIFF OMITTED] T1270A.308 [GRAPHIC] [TIFF OMITTED] T1270A.309 [GRAPHIC] [TIFF OMITTED] T1270A.310 [GRAPHIC] [TIFF OMITTED] T1270A.311 [GRAPHIC] [TIFF OMITTED] T1270A.312 [GRAPHIC] [TIFF OMITTED] T1270A.313 [GRAPHIC] [TIFF OMITTED] T1270A.314 [GRAPHIC] [TIFF OMITTED] T1270A.315 [GRAPHIC] [TIFF OMITTED] T1270A.316 [GRAPHIC] [TIFF OMITTED] T1270A.317 [GRAPHIC] [TIFF OMITTED] T1270A.318 [GRAPHIC] [TIFF OMITTED] T1270A.319 [GRAPHIC] [TIFF OMITTED] T1270A.320 [GRAPHIC] [TIFF OMITTED] T1270A.321 [GRAPHIC] [TIFF OMITTED] T1270A.322 [GRAPHIC] [TIFF OMITTED] T1270A.323 [GRAPHIC] [TIFF OMITTED] T1270A.324 [GRAPHIC] [TIFF OMITTED] T1270A.325 [GRAPHIC] [TIFF OMITTED] T1270A.326 [GRAPHIC] [TIFF OMITTED] T1270A.327 [GRAPHIC] [TIFF OMITTED] T1270A.328 [GRAPHIC] [TIFF OMITTED] T1270A.329 [GRAPHIC] [TIFF OMITTED] T1270A.330 [GRAPHIC] [TIFF OMITTED] T1270A.331 [GRAPHIC] [TIFF OMITTED] T1270A.332 [GRAPHIC] [TIFF OMITTED] T1270A.333 [GRAPHIC] [TIFF OMITTED] T1270A.334 [GRAPHIC] [TIFF OMITTED] T1270A.335 [GRAPHIC] [TIFF OMITTED] T1270A.336 [GRAPHIC] [TIFF OMITTED] T1270A.337 [GRAPHIC] [TIFF OMITTED] T1270A.338 [GRAPHIC] [TIFF OMITTED] T1270A.339 [GRAPHIC] [TIFF OMITTED] T1270A.340 [GRAPHIC] [TIFF OMITTED] T1270A.341 [GRAPHIC] [TIFF OMITTED] T1270A.342 [GRAPHIC] [TIFF OMITTED] T1270A.343 [GRAPHIC] [TIFF OMITTED] T1270A.344 [GRAPHIC] [TIFF OMITTED] T1270A.345 [GRAPHIC] [TIFF OMITTED] T1270A.346 [GRAPHIC] [TIFF OMITTED] T1270A.347 [GRAPHIC] [TIFF OMITTED] T1270A.348 [GRAPHIC] [TIFF OMITTED] T1270A.349 [GRAPHIC] [TIFF OMITTED] T1270A.350 [GRAPHIC] [TIFF OMITTED] T1270A.351 [GRAPHIC] [TIFF OMITTED] T1270A.352 [GRAPHIC] [TIFF OMITTED] T1270A.353 [GRAPHIC] [TIFF OMITTED] T1270A.354 [GRAPHIC] [TIFF OMITTED] T1270A.355 [GRAPHIC] [TIFF OMITTED] T1270A.356 [GRAPHIC] [TIFF OMITTED] T1270A.357 [GRAPHIC] [TIFF OMITTED] T1270A.358 [GRAPHIC] [TIFF OMITTED] T1270A.359 [GRAPHIC] [TIFF OMITTED] T1270A.360 [GRAPHIC] [TIFF OMITTED] T1270A.361 [GRAPHIC] [TIFF OMITTED] T1270A.362 [GRAPHIC] [TIFF OMITTED] T1270A.363 [GRAPHIC] [TIFF OMITTED] T1270A.364 [GRAPHIC] [TIFF OMITTED] T1270A.365 [GRAPHIC] [TIFF OMITTED] T1270A.366 [GRAPHIC] [TIFF OMITTED] T1270A.367 [GRAPHIC] [TIFF OMITTED] T1270A.368 [GRAPHIC] [TIFF OMITTED] T1270A.369 [GRAPHIC] [TIFF OMITTED] T1270A.370 [GRAPHIC] [TIFF OMITTED] T1270A.371 [GRAPHIC] [TIFF OMITTED] T1270A.372 [GRAPHIC] [TIFF OMITTED] T1270A.373 [GRAPHIC] [TIFF OMITTED] T1270A.374 [GRAPHIC] [TIFF OMITTED] T1270A.375 [GRAPHIC] [TIFF OMITTED] T1270A.376 [GRAPHIC] [TIFF OMITTED] T1270A.377 [GRAPHIC] [TIFF OMITTED] T1270A.378 [GRAPHIC] [TIFF OMITTED] T1270A.379 [GRAPHIC] [TIFF OMITTED] T1270A.380 [GRAPHIC] [TIFF OMITTED] T1270A.381 [GRAPHIC] [TIFF OMITTED] T1270A.382 [GRAPHIC] [TIFF OMITTED] T1270A.383 [GRAPHIC] [TIFF OMITTED] T1270A.384 [GRAPHIC] [TIFF OMITTED] T1270A.385 [GRAPHIC] [TIFF OMITTED] T1270A.386 [GRAPHIC] [TIFF OMITTED] T1270A.387 [GRAPHIC] [TIFF OMITTED] T1270A.388 [GRAPHIC] [TIFF OMITTED] T1270A.389 [GRAPHIC] [TIFF OMITTED] T1270A.390 [GRAPHIC] [TIFF OMITTED] T1270A.391 [GRAPHIC] [TIFF OMITTED] T1270A.392 [GRAPHIC] [TIFF OMITTED] T1270A.393 [GRAPHIC] [TIFF OMITTED] T1270A.394 [GRAPHIC] [TIFF OMITTED] T1270A.395 [GRAPHIC] [TIFF OMITTED] T1270A.396 [GRAPHIC] [TIFF OMITTED] T1270A.397 [GRAPHIC] [TIFF OMITTED] T1270A.398 [GRAPHIC] [TIFF OMITTED] T1270A.399 [GRAPHIC] [TIFF OMITTED] T1270A.400 [GRAPHIC] [TIFF OMITTED] T1270A.401 [GRAPHIC] [TIFF OMITTED] T1270A.402 [GRAPHIC] [TIFF OMITTED] T1270A.403 [GRAPHIC] [TIFF OMITTED] T1270A.404 [GRAPHIC] [TIFF OMITTED] T1270A.405 [GRAPHIC] [TIFF OMITTED] T1270A.406 [GRAPHIC] [TIFF OMITTED] T1270A.407 [GRAPHIC] [TIFF OMITTED] T1270A.408 [GRAPHIC] [TIFF OMITTED] T1270A.409 [GRAPHIC] [TIFF OMITTED] T1270A.410 [GRAPHIC] [TIFF OMITTED] T1270A.411 [GRAPHIC] [TIFF OMITTED] T1270A.412 [GRAPHIC] [TIFF OMITTED] T1270A.413 [GRAPHIC] [TIFF OMITTED] T1270A.414 [GRAPHIC] [TIFF OMITTED] T1270A.415 [GRAPHIC] [TIFF OMITTED] T1270A.416 [GRAPHIC] [TIFF OMITTED] T1270A.417 [GRAPHIC] [TIFF OMITTED] T1270A.418 [GRAPHIC] [TIFF OMITTED] T1270A.419 [GRAPHIC] [TIFF OMITTED] T1270A.420 [GRAPHIC] [TIFF OMITTED] T1270A.421 [GRAPHIC] [TIFF OMITTED] T1270A.422 [GRAPHIC] [TIFF OMITTED] T1270A.423 [GRAPHIC] [TIFF OMITTED] T1270A.424 [GRAPHIC] [TIFF OMITTED] T1270A.425 [GRAPHIC] [TIFF OMITTED] T1270A.426 [GRAPHIC] [TIFF OMITTED] T1270A.427 [GRAPHIC] [TIFF OMITTED] T1270A.428 [GRAPHIC] [TIFF OMITTED] T1270A.429 [GRAPHIC] [TIFF OMITTED] T1270A.430 [GRAPHIC] [TIFF OMITTED] T1270A.431 [GRAPHIC] [TIFF OMITTED] T1270A.432 [GRAPHIC] [TIFF OMITTED] T1270A.433 [GRAPHIC] [TIFF OMITTED] T1270A.434 [GRAPHIC] [TIFF OMITTED] T1270A.435 [GRAPHIC] [TIFF OMITTED] T1270A.436 [GRAPHIC] [TIFF OMITTED] T1270A.437 [GRAPHIC] [TIFF OMITTED] T1270A.438 [GRAPHIC] [TIFF OMITTED] T1270A.439 [GRAPHIC] [TIFF OMITTED] T1270A.440 [GRAPHIC] [TIFF OMITTED] T1270A.441 [GRAPHIC] [TIFF OMITTED] T1270A.442 [GRAPHIC] [TIFF OMITTED] T1270A.443 [GRAPHIC] [TIFF OMITTED] T1270A.444 [GRAPHIC] [TIFF OMITTED] T1270A.445 [GRAPHIC] [TIFF OMITTED] T1270A.446 [GRAPHIC] [TIFF OMITTED] T1270A.447 [GRAPHIC] [TIFF OMITTED] T1270A.448 [GRAPHIC] [TIFF OMITTED] T1270A.449 [GRAPHIC] [TIFF OMITTED] T1270A.450 [GRAPHIC] [TIFF OMITTED] T1270A.451 [GRAPHIC] [TIFF OMITTED] T1270A.452