The following is a letter sent by Verified Voting to the New York State Board of Election on January 12, 2021.
January 12, 2021
New York State Board of Elections (via email election_ops@elections.ny.gov)
40 North Pearl Street
Suite 5
Albany, NY 12207-2729
RE: Verified Voting opposition to certifying ES&S ExpressVote XL voting system
Dear Commissioners:
We submit these comments in opposition to the certification of the ES&S ExpressVote XL voting machine for New York’s elections. Verified Voting, a non-partisan organization focused exclusively on the critical role technology plays in election administration, has a mission to strengthen democracy for all voters by promoting the responsible use of technology in elections. As such, we find that the ES&S ExpressVote XL fails to address critical issues in protecting voters’ choices and the security of the overall voting process.
The ES&S ExpressVote XL suffers from fundamental design flaws, particularly with respect to voter verification, that go beyond the discrepancies cited in the NYSTEC report and cannot be readily resolved.
Barriers to Voter Verification (SLI Discrepancy ESS6041-12)
There is no question that voters need the ability to verify their selections before casting their votes. Voter verification of paper ballots (or functionally equivalent paper records) is integral to voting system security and public confidence. If voters do not know that their paper ballots correctly record their intended votes, no post-election audit or recount of the ballots can demonstrate the validity of the vote counts. In studying ballot marking devices and voter verification, researchers found that “absent specific interventions, error detection and reporting rates are dangerously low.”1 Even in comparison to other ballot marking devices, the ExpressVote XL makes verification nearly impossible for many voters with disabilities, and more difficult for other voters, by retaining the paper vote record behind a window. The NYSTEC report acknowledges the problem and calls for “voter education” — but, bluntly, no voter education strategy is known to address the XL’s deficiencies.
SLI Discrepancy ESS6041-12 documents an additional barrier to voter verification that directly violates New York rule: the “Cast Ballot” pop-up covers part of the ballot review screen, preventing a complete comparison with the printed paper record. In principle, this problem could be corrected — but the fundamental obstacle to voter verification is inherent when the ExpressVote XL is used in tabulator mode.
Insufficient Support for Alternative Languages (SLI Discrepancy ESS6041-18)
The ExpressVote XL only prints a paper vote record in English and does not support other languages. NYSTEC points out that this “does not meet NYS requirement 6209.2.F.3.” This shortcoming is especially distressing because New York City, which has attempted to acquire the ExpressVote XL, provides election support for voters in many languages, including several that do not use the Latin alphabet. Ballot-on-demand printers could far better serve voters’ varied language needs.
Additional Risks
The ExpressVote XL presents certain additional threats to voting security and challenges to voters as they cast their votes. Below we outline some of those risks and challenges, as also presented in the NYSTEC report.
Barcodes
The ExpressVote XL voting system uses barcodes in tabulating voters’ selections. Voters are unable to verify or confirm that the printed barcode actually matches their selection. We agree with NYSTEC’s assessment of this risk: “the largest impact of this threat could be in public confidence of the system, as it is a change in technology from the optical mark ballot scanner solutions which have been in use for years.” At a time of widespread public fear about election systems and processes, it is rash to introduce barcodes that obfuscate whether voters’ votes have been recorded correctly. The NYSTEC report offers post-election audits as a technical means to confirm that the machine tallies from the barcodes correspond with the human-readable text of the paper vote records. But a far more robust approach to the public confidence threat is to eschew barcodes altogether.
Shared Printer and Scanner Path
The paper vote record used by ExpressVote shares the same physical path when the card is being printed as when it is being scanned. The risk herein is that the printer could print on a card as it is being scanned (and counted) and could potentially change the user’s selections. One way in which this could happen is through adding additional, or new, barcodes to the card — after it is cast by the voter. The report dismisses this risk on the grounds that, as tested in New York, the XL prints “X”s to fill in any blank spaces, thus not allowing new barcodes to be added. This argument fails. If the printer can be hacked to add barcodes, it can be hacked not to print those “X”s. It should not be incumbent upon the voter to check whether or not those “X”s have been printed on the card. Moreover, the voting system should not be able to alter the permanent record of people’s votes in any way once they have cast their votes.
Conclusion
It is our opinion that given these design flaws and unresolved discrepancies, the ExpressVote XL is not suitable for certification. Given that the NYSBOE’s mission includes “the preservation of citizen confidence in the democratic process and enhancement in voter participation in elections,” it would be a disservice to the voters of the state of New York to certify such a system with its unnecessary security risks and pitfalls. We recommend that the Board not certify the ExpressVote XL voting system.
Respectfully submitted,
Mark Lindeman, Interim Co-Director
C.Jay Coles, Audit Specialist
Chrissa LaPorte, Program Associate
- Bernhard, M., McDonald, A., Meng, H., Hwa, J., Bajaj, N., Chang, K., & Halderman, J. A. (2020). Can Voters Detect Malicious Manipulation of Ballot Marking Devices?. In 41st IEEE Symposium on Security and Privacy. [↩]