1 of 97

Recount 2016

�Matthew Bernhard

Verified Voting

An uninvited security audit

of the U.S. presidential election

2 of 97

2016 U.S. Presidential Election

Donald Trump

Republican

Hillary Clinton

Democrat

November 8, 2016

3 of 97

Predictions were for a Clinton Win

4 of 97

Predictions were for a Clinton Win

5 of 97

Predictions were for a Clinton Win

6 of 97

Predictions were for a Clinton Win

Nearly everyone predicted victory for Clinton...

7 of 97

8 of 97

Election Results

Clinton received nearly �3 million more votes, �but Trump won the electoral college.

Not Really...

9 of 97

What Happened?

Explanation A:�Systematically Wrong Polls

Explanation B:�Results Were Rigged

Probably not!

Is rigging actually feasible?

How can we find out �which explanation is true?

10 of 97

American Elections

11 of 97

U.S. Elections

Massive Scale

Highly Distributed�State, county, and local levels

High Complexity�Ballots with many different races,

Over a dozen languages

Sensitive to Latency�Want results on election night

200 million registered voters |

13,000 voting jurisdictions |

187,000 election precincts

|

52 models of voting machines |

12 of 97

U.S. Elections Scale and Complexity

Election Technology by U.S. State

13 of 97

U.S. Elections Scale and Complexity

Election Technology by County: State of Arkansas

14 of 97

U.S. Elections Long, Complicated Ballots

  • US Elections are incredibly distributed
    • elections are often run at the finest grain of governance: municipality
    • Decisions about election systems vary widely from state to state, county to county, and city to city

15 of 97

U.S. Voting Machines 2 Styles, 52 Models

Optical Scan

Computer counts paper ballots as they’re placed in ballot box

DRE (Direct Recording Electronic)

Votes cast on-screen, recorded in memory;�sometimes prints paper audit records (VVPATs)

16 of 97

Are U.S. Voting Machines Secure?

17 of 97

18 of 97

19 of 97

20 of 97

21 of 97

22 of 97

23 of 97

24 of 97

25 of 97

26 of 97

27 of 97

Are U.S. Voting Machines Secure?

Diebold AccuVote TSX

Cards spread malware (2007)

ES&S iVotronic

Cards spread malware (2007)

Diebold AccuVote OS

Cards spread malware (2007)

ES&S Model 100

Cards spread malware (2007)

Hart InterCivic eSlate

Cards spread malware (2007)

AVC Advantage

Cards spread malware (2009)

Sequoia AVC Edge

Cards spread malware (2007)

Optech Insight

Cards spread malware (2007)

Every U.S. voting machine subjected to rigorous independent security review �suffered vulnerabilities that allow the spread of vote-stealing malware.

28 of 97

Hacking an Election?

29 of 97

Election Hacking Visible Attacks

Alter election-night results�Undermines credibility, even if detected

Denial of serviceSelectively cause long lines, etc.

Political interference�Selectively discredit candidates

30 of 97

Election Hacking Visible Attacks

Alter election-night resultsUndermines credibility, even if detected

Denial of serviceSelectively cause long lines, etc.

Political interference�Selectively discredit candidates

31 of 97

Election Hacking Visible Attacks

Alter election-night results�Undermines credibility, even if detected

Denial of serviceSelectively cause long lines, etc.

Political interferenceSelectively discredit candidates

July: Democratic National Committee emails� hacked; leaked to press

August: Voter registration systems in Illinois and Arizona� hacked; other states probed

October: John Podesta (Clinton’s campaign manager)� email hacked; leaked to press

32 of 97

Election Hacking Invisible Attacks

How hard would it be to invisibly�change the outcome, by tampering�with the voting machines?

Challenge 1�Diverse, decentralized voting technology

Challenge 2�Machines aren’t connected to the Internet��

Challenge 3�70% of U.S. votes have a paper record��

33 of 97

Election Hacking Invisible Attacks

How hard would it be to invisibly�change the outcome, by tampering�with the voting machines?

Challenge 1�Diverse, decentralized voting technology

Challenge 2�Machines aren’t connected to the Internet��

Challenge 3�70% of U.S. votes have a paper record��

34 of 97

Election Hacking Invisible Attacks

How hard would it be to invisibly�change the outcome, by tampering�with the voting machines?

Challenge 1�Diverse, decentralized voting technologyNeed to swap <1% of votes in two states.

Challenge 2�Machines aren’t connected to the Internet��

Challenge 3�70% of U.S. votes have a paper record��

35 of 97

Election Hacking Invisible Attacks

How hard would it be to invisibly�change the outcome, by tampering�with the voting machines?

Challenge 1�Diverse, decentralized voting technologyNeed to swap <1% of votes in two states.

Challenge 2Machines aren’t connected to the Internet��

Challenge 3�70% of U.S. votes have a paper record��

36 of 97

If infected, can spread malware to all machines across one or more counties

Centralized election management computer programs ballot design to memory cards before each election

37 of 97

How hard would it be �to attack an election management computer?

Many jurisdictions outsource �their ballot programming �to small, outside businesses.

75% of Michigan counties use �just two ~20 person companies.

38 of 97

Election Hacking Invisible Attacks

How hard would it be to invisibly�change the outcome, by tampering�with the voting machines?

Challenge 1�Diverse, decentralized voting technologyNeed to swap <1% of votes in two states.

Challenge 2Machines aren’t connected to the InternetCards programmed using centralized �election management computers.

Challenge 3�70% of U.S. votes have a paper record

39 of 97

Election Hacking Invisible Attacks

How hard would it be to invisibly�change the outcome, by tampering�with the voting machines?

Challenge 1�Diverse, decentralized voting technologyNeed to swap <1% of votes in two states.

Challenge 2Machines aren’t connected to the InternetCards programmed using centralized �election management computers.

Challenge 3�70% of U.S. votes have a paper record

40 of 97

41 of 97

Paper as a Defense

42 of 97

Use of Paper has Increased

Over 70% of votes cast in 2016 �were recorded on paper.

43 of 97

Post-election auditing lacks coverage

Over 70% of votes cast in 2016 �were recorded on paper.

44 of 97

Election Hacking Invisible Attacks

How hard would it be to invisibly�change the outcome, by tampering�with the voting machines?

Challenge 1�Diverse, decentralized voting technologyNeed to swap <1% of votes in two states.

Challenge 2Machines aren’t connected to the InternetCards programmed using centralized �election management computers.

Challenge 3�70% of U.S. votes have a paper recordMost states rarely or never look at paper!

45 of 97

Election Hacking Invisible Attacks

How hard would it be to invisibly�change the outcome, by tampering �with the voting machines?

Step 2

Target large counties or service providers, and compromise election management computers.

Easier than you thought! .

Step 1

Use pre-election polls to �identify likely close states.

Step 3

Infected memory cards exploit vulnerable voting machines to run malware,

swap, e.g., 10% of votes.

Step 4�Most states just�throw away the�paper ballots.

46 of 97

An Uninvited Security Audit

47 of 97

Hacking Was Plausible How To Check?

After Election Day (Nov. 8), we knew:

Presidential results were extremely close, defied polling.

U.S. alleged Russian political cyberattacks during campaign.

Feasible to attack enough machines to have changed outcome.

Shockingly, even under these circumstances,�no state would examine enough evidence�to expose such an attack.�Five weeks until results are locked in on Dec. 13.

Will we ever be able to confirm outcome was correct?

We and other election integrity advocates wonder what to do?

November & December 2016

8 9 10 11 12

13 14 15 16 17 18 19

20 21 22 23 24 25 26

27 28 29 30 1 2 3

4 5 6 7 8 9 10

11 12 13 .

48 of 97

Would Clinton Demand a Recount?

Call with Clinton Campaign

  • Where’s evidence of fraud? (!!!)
  • How to pay for recounts?
  • Backpedalling her concession?

November & December 2016

8 9 10 11 12

13 14 15 16 17 18 19

20 21 22 23 24 25 26

27 28 29 30 1 2 3

4 5 6 7 8 9 10

11 12 13 .

49 of 97

In third presidential debate, Trump refused to�say he would accept the election results.

“He said something truly horrifying…. A direct threat to our democracy.”.

50 of 97

New Idea: Any Candidate can Demand a Recount!

Election integrity advocate.

On ballot in most states .� Won 1.06% of the vote .

Willing to lead recounts! .

November & December 2016

8 9 10 11 12

13 14 15 16 17 18 19

20 21 22 23 24 25 26

27 28 29 30 1 2 3

4 5 6 7 8 9 10

11 12 13 .

Jill Stein�2016 Green Party �Presidential Candidate

51 of 97

An Accidental Media Circus

they’ve found persuasive. � evidence that the results … .� may have been hacked.”.

.The only way to know whether a. .cyberattack changed the result is to. .examine the physical evidence:..paper ballots and voting equipment.

52 of 97

International News

53 of 97

How to Pay? Crowdfunding!

In two days, raised $5M .

After two weeks, $7M .

Over 160,000 donors! .

November & December 2016

8 9 10 11 12

13 14 15 16 17 18 19

20 21 22 23 24 25 26

27 28 29 30 1 2 3

4 5 6 7 8 9 10

11 12 13 .

54 of 97

Where to Recount?

55 of 97

Where to Recount?

56 of 97

Where to Recount? Wisconsin, Michigan, Pennsylvania

All three projected for Clinton, �won by Trump

�Combined 46 electoral votes

� All three had margins <0.8%,� in total decided by fewer than � 78,000 votes

MI and WI allow candidates � to petition for a recount, � PA requires court order

Wisconsin

Pennsylvania

Michigan

57 of 97

Wisconsin 10 electoral votes

Wisconsin

Margin�22,748 votes (0.77%)

Technology�Almost entirely opscan �All votes use paper

Law�Any candidate can demand a recount if they pay the cost

Each county decides recount method: hand count or rescan

58 of 97

Michigan 16 electoral votes

Margin

10,704 votes (0.23%)

TechnologyEntirely opscan,�All votes use paper�

Law�Any “aggrieved” candidate can pay statutory fee for recount

State Board of Canvassers decides recount method

Michigan

.Uni. of Michigan.

59 of 97

Pennsylvania 20 electoral votes

Margin

44,292 votes (0.72%)

Technology

Mostly paperless DREs�Only ~30% of votes use paper

Law

Three citizens from each �precinct must file, swear there�is fraud, and post bond to get

a recount in that precinct.

Automatic statewide recount �if margin is less than 0.5%.

Pennsylvania

60 of 97

Why Not Other States?

New Hampshire . . . . . . . . deadline passed 6 days after election

Virginia . . . . . . . . . . . . . . . illegal to recount unless margin of victory� is under 1% (Clinton won by 4.9%)

California . . . . . . . . . . . . . margin of victory in California was 30%

Trump could have initiated his own recounts, but did not..

61 of 97

Let the (Re)counting Begin

62 of 97

63 of 97

Let the Recounting Begin!

First recount petition filed, in Wisconsin, Nov. 25 .

President-elect Trump not a fan .

He and his lawyers would oppose efforts in all three states .

November & December 2016

8 9 10 11 12

13 14 15 16 17 18 19

20 21 22 23 24 25 26

27 28 29 30 1 2 3

4 5 6 7 8 9 10

11 12 13 .

64 of 97

Others did the Real Work

Assistance from 10,000 Green Party volunteers!

EMERY CELLI BRINCKERHOFF & ABADY LLP

Attorneys: Matthew Brinckerhoff, Jonathan Abady, Ilann Maazel, Debbie Greenberger.�Ali Frick, David Lebowitz, Hayley Horowitz, Doug Lieb, Jessica Clarke … and others

More than half-dozen simultaneous legal actions!

Testimony from leading e-voting experts: Philip Stark, Harri Hursti, Doug Jones, Ron Rivest, Dan Wallach, Poorvi Vora, Duncan Buell, Dan Lopresti, and Candice Hoke

65 of 97

What Does a Recount Look Like? Like this...

Washtenaw County, Michigan .

66 of 97

What Does a Recount Look Like? ...and also like this

67 of 97

What Does a Recount Look Like? ...and also like this

Lansing, Michigan .

68 of 97

What Does a Recount Look Like? ...and also like this

Philadelphia, Pennsylvania .

69 of 97

What Does a Recount Look Like? ...and also like this

Philadelphia, Pennsylvania .

70 of 97

What Does a Recount Look Like? ...and also like this

71 of 97

The Election is Decided

72 of 97

Electoral Outcome

73 of 97

Recount Outcome … no state completed a full hand recount

74 of 97

Recount Outcome … no state completed a full hand recount

Wisconsin . . . . Recounted statewide, though not all by hand 51 counties counted by hand, 9 by re-scanning, 12 by a combination� 11,883 vote corrections (over half the margin of victory!)� Net change: 397 votes. No evidence of an attack.

Michigan . . . . . Halted after three days under opposition from state and Trump 10 counties finished, 12 started but did not finish (out of 83)� 2,099,578 ballots recounted (43% of total cast).� Net change: 1651 votes. No evidence of an attack.

Pennsylvania . . Defeated in federal court under opposition from state and Trump

One county (out of 67) recounted by hand, and only 143 of its 228 precincts� No published results. Presumably no evidence of an attack?� Lesson: It is really difficult to audit the votes in Pennsylvania!

75 of 97

Recount Outcome Other problems exposed in Michigan

76 of 97

Using the Available Evidence

What we really want:�Statistical Risk-Limiting Audit

Much cheaper than a full recount and yields the same confidence.

What we actually have:

Incomplete, non-random county-level samples. What to do?

Hand count randomly sampled precincts until you establish,�with high statistical confidence, that hand-counting all of the paper records would yield the same winner.

77 of 97

Using the Available Evidence

Recounts let us rule out some attack scenarios (e.g., statewide fraud).�What about other scenarios?

  • Attacker seeks to suppress the vote
    • Focus on votes for one candidate
    • Focus on one means of voting (e.g. vote-by-mail or accessibility)
  • Attacker compromises election vendors
  • Attacker compromises specific voting machines
    • Potentially machines used in recounts

If the randomly selected counties were recounted by hand, then this attempt �to throw the election is considered detected.

78 of 97

Cyberattacks Did Happen, Before the Election

79 of 97

Cyberattacks Did Happen, Before the Election

80 of 97

Using the Available Evidence

81 of 97

Using the Available Evidence

Methodology:

  • Focus on differences in signs of the original count-vs-recount vote totals for each candidate
    • E.g., did a candidate gain or lose votes in the recount
  • Contrast unlabelled differences with labelled differences
    • Does the candidate impact whether or not they gained or lost votes?
  • Use multinomial regression to account for correlating factors like vendors, votes for a particular candidate, voting technology, etc.
  • If labelled and unlabelled differences aren’t the same, and these correlate to a specific regressor, this is indicative of fraud

82 of 97

Using the Available Evidence: Results

Wisconsin

  • No regressors correlated significantly
  • No significant differences between hand and machine recounts
  • Overall no evidence that fraud affected outcome
  • One machine saw significantly higher error rates: Optech IIIP-Eagle

83 of 97

Using the Available Evidence: Results

84 of 97

Using the Available Evidence: Results

Wisconsin

  • No regressors correlated significantly
  • No significant differences between hand and machine recounts
  • Overall no evidence that fraud affected outcome
  • One machine saw significantly higher error rates: Optech IIIP-Eagle

Michigan

  • No regressors correlated significantly
  • No evidence that fraud affected outcome in recounted places
  • Revealed significant issues in Detroit

85 of 97

Using the Available Evidence: Results

86 of 97

Lessons & Conclusion

87 of 97

Lessons

Hacking a U.S. presidential election even easier than we thought!

  • Vulnerable machines and central points of attack can be exploited �to steal votes in jurisdictions across multiple swing states.
  • States unlikely to look at paper, even in a close election with �surprising results and known cyberattacks by a foreign power.
  • Even if candidates try to force a recount, many opportunities for apparent winner to put up legal roadblocks, as they inevitably will, whoever wins.

88 of 97

Lessons

This election probably wasn’t hacked ... what about next time?

U.S. badly needs to reform its voting system

  • Make attacks more difficult: Harden voting technology
  • Ensure attacks detectable: Implement 100% paper ballotsStates that need to act: IN, TX, NJ, MS, TN, NC, LA, AR, KS, IL, KY
  • Use the physical evidence: Impose mandatory risk-limiting audits�Cheaper than full recounts; should be done routinely in every national election

89 of 97

Use of Paper has Increased even more since 2016

Over 70% of votes cast in 2016 �were recorded on paper.

90 of 97

Use of Paper has Increased even more since 2016

Over 84% of votes cast in 2020 �will be recorded on paper.

91 of 97

Risk-limiting audits have increased since 2016

92 of 97

93 of 97

Philadelphia’s old voting machine

Danaher Shouptronic 1242

  • Ancient
  • Paperless

94 of 97

Philadelphia’s new voting machine

ExpressVote XL

  • Is new!*
  • Has paper!*

95 of 97

What can you do?

  • Vote!
  • Become a poll worker
  • Get to know your local election official
  • Write to your state legislators and congresspeople emphasizing:
    • the need for paper ballots
    • risk-limiting audits
    • funding to facilitate secure elections at the state and local level

96 of 97

Recount 2016

Matthew Bernhard

matber@umich.edu

@umbernhard

Verified Voting

An uninvited security audit

of the U.S. presidential election

97 of 97