Election Law Housekeeping

by Janice Dysinger

“This is just housekeeping legislation.” The Oregon Legislative House Rules Committee is looking at HB 4174. One of the things covered in this bill is related to election security: Secretary of State Kate Brown’s continuing attempt to set aside ORS 254.483. She says this law, mandating the destruction of unused ballots at 8 PM on Election Day, is poorly written, confusing, and left over from election laws in force prior to the institution of vote by mail. The elections offices do not follow this law currently. Blank ballots are kept in the elections office throughout an election cycle.

While I applaud Kate Brown for wanting to be a good housekeeper, I feel obligated to point out a few things regarding our election practices.

A few years ago, several of us started focusing our efforts on observing the election procedures in Multnomah County. We enlisted the help of several Oregonians including Andrew Nisbet and his associate Robert McCullough of McCullough Research. McCullough Research discovered and investigated the Enron scandal from its office in Portland, Oregon. In 2010, they were kind enough to come and evaluate the electronic security of election practices in Multnomah County as a public service. Their report can be read here.  After their evaluation, they let the Multnomah County Elections Division know of their concerns. Since then, we have presented these findings to County Commissioners, the County Auditor, and State Legislators.

Oregon law provides a check to insure our elections are fair: a public test of the counting machines. Tabulation of the ballots is supposed to be electronically isolated from outside influences. The system is, except for the fact that an untested USB drive collects the report from the Unity Machine USB port each time the election results are updated. That USB drive is taken to the outer office and put in one of the untested PCs in the office. The results of the election are then disseminated to the public through the media and reported to the Secretary of State’s office. The same procedure is repeated each time there is an update. We observed a box of USB drives in the ballot counting room, just sitting on a shelf next to the Unity Machine. Are the USB drives reused? These USB drives and the outside PCs (which are connected to the Internet) are not part of the public test that establishes the security of the election. Robert McCullough advised me that this does not meet industry standard for security. He said “It is similar to leaving keys to a convertible car in the ignition, parking it outside on the curb, and walking away. No one may have stolen it yet, but it is vulnerable.”

ORS 254.074 says the Secretary of State must approve of the ‘secret security plan’ for the Elections Office or the election will not go forward. It is her duty to see that the process is secure. Much of the plan is unavailable to the public as it is part of a ”secret security plan’. If there are breaches in the security, the Secretary of State is not obligated to tell the public. (sub section 3)

If the Unity Machine were to become compromised by malware, as McCullough reports is possible, and if someone were to call for a recount, we would see if the results in the precinct boxes matched the Unity Machine report. That is a valid check. Except…. in a regular election in Multnomah County, there are tens of thousands of extra blank ballots at the elections office because ORS 254.483 is being purposefully ignored. Could these ballots be utilized for mischief, to alter the precinct box count? Additionally, another 30-40 thousand returned undeliverable ballots are kept as ‘archival documents’ for as long as 7 months after an election, each with a blank ballot inside. These ballots left in play leave our elections vulnerable to fraud.

Oregon Legislators must retain ORS 254.483 as the law. The Secretary of State needs to be required to follow it.  Our Unity Machine needs to be isolated electronically, USB drives removed and software inspected with both political parties present and able to see the software. There is a simple solution for obtaining the election results: a printer. Scan the printed results into the office PCs for dissemination to the public and the Secretary of State’s office.  Shred all blank ballots in the Election office at 8 PM on election night as the law requires. It’s time for some REAL housekeeping.

http://www.leg.state.or.us/ors/254.html

(1) The county clerk shall destroy all unused absentee and regular ballots in the county clerk’s possession.
(2) Each county shall provide for the security of, and shall account for, unused ballots. [Formerly 254.475; 2007 c.154 §43]