Friday, September 30, 2005

CAMBER comments re: Voluntary Voting System Guidelines

Mr. Eustis:

This is the CAMBER comment on the Voluntary Voting System Guidelines.

Included in our comment is a copy of our August 24th letter to Ms. Hillman which is included below. Also included in our comment is a sketch of a brochure that outlines the level of documentation that we expect, see below.

The final technical guidelines should fit in a small pamphlet.

Please ensure that our comment is not rejected, is available to reviewers online, and will receive proper consideration and a response. If you wish, follow this instruction: (a) DELETE VOLUME I, (b) DELETE VOLUME II, and INSERT this document including its attachments.


It is clear to me that the TGDC has not spent enough time considering the audience for the guidelines. We believe that the audience includes: judges, attorneys, district attorneys, attorneys general, secretary of state, county clerks, election officials, legislators, political parties, political campaigns, Election workers, poll watchers, vendors, application developers, application and system testers, independent testing authorities, the public and the press.

A summary of the document is not a solution. For example, the Court, in order to decide a case being litigated before it, must comprehend and make its determination on the official document itself. The current work product does not meet the needs of its audience.

What is needed

A trivial example of what is needed might be helpful. Consider what the individual members of the TGDC would write if they were asked to document their personal requirements for a car. I would anticipate that their individual requirements could be grouped into fairly regular categories such as: comfort, safety, performance, price, operating cost, service, and warrantee. I anticipate that few, if any, members would differentiate between the type of ignition system used to start the engine.

The current guidelines are aimed at the wrong things, because they are not aimed at the right audience.

National expense

The direction that the work is heading would be prohibitively expensive to maintain and impossible to litigate.

Citizens for Accurate Mail Ballot Election Results
2867 Tincup Circle
Boulder, CO 80305


August 24, 2005

Ms. Hillman,

Again I compliment you for your wonderfully insightful questions of panelists at yesterday’s EAC hearing in Denver. I deduce from your questions that you truly want to represent the interests of the public.

You don’t know me, so you won’t know how much weight to attribute to the following comments. I hope that you will take them seriously.

1. The problem that you and the other commissioners appear to sense with the VVSG is that the VVSG is both voluminous and complex. I concur with this appraisal. In fact, I would go a step further and say that the VVSG is unusable because of its volume and complexity. Writing a superficial overview will not suddenly make the VVSG useable. Editing the VVSG will not make it useable. The problem with the guide is fundamental -- it is aiming at the wrong target, and it is using the wrong ammunition.

a. The guide is incomplete (wrong target). The election system involves many components – the VVSP addresses very few of them. For example, the guide does not address public oversight, yet public oversight is a fundamental component of a trustworthy election process. The guide does not address procedures, such as authentication that a voter is the person who they claim to be. All of the components of the election system must be identified, and must be documented in a high-level systems diagram supplemented with a high level systems description. The diagram and description must be void of specific implementation details, and must not require change for different implementations. The current guide violates these precepts.

b. The guide addresses implementation-level details (wrong ammo). The VVSG should specify only: required results, measurement specifications for each result, acceptable performance for each result, and consequences when the required result is not achieved. HOW the result is achieved must be invisible in the VVSG. Instead, this guide is burdened with detailed descriptions of how things are to be done for specific implementations. For example, there is no general requirement that people and procedures be tested and measured. One of the problems with the approach taken in the VVSG is that it will require revision every time a new technology is introduced. Remember, it will take years before any VVSG change will be reflected in a majority of the nation’s voting systems. Unless changed to reflect principles rather than implementations, the VVSG will fail in its goal of returning public trust to the election system.

2. The proposal for accreditation of Testing Laboratories and the testing process itself is headed in the wrong direction.

a. Missing, for example, is a way to pay for the testing. The vendors should not pay, because that would compromise the integrity of the Testing Labs. The people should not pay for overly expensive or frivolous tests, and should be compensated through penalty fees, for poor vendor performance.

b. There is nothing proposed that will motivate vendors to withhold certification requests until they have a very high degree of confidence that the certification process will not discover a deviation between requirements and the implementation.

c. The role of the public, and in particular the interested professional computer scientists, is missing.

d. There is no penalty when a Testing Lab fails to detect problems that make it into production. How is a lab de-certified?

e. Who is accountable for the quality of the election process?

f. Also, because of the fundamental problems with the VVSG, described above, the Testing Labs are going to be testing the wrong stuff. There is a difference between systems testing that is aimed at requirements and architecture (what), and implementation testing that is aimed at implementation specifications (how).

Few people have the skills needed to draw the elegant line between requirements/architecture and the implementation specifications. The VVSG desperately needs these skills. Unless the VVSG is revamped, I anticipate that it will become a burden on the public. It will generate enormous costs, fail to deliver quality, and be rejected by the public as a solution to their concerns.

Finally, yesterday it was suggested by staff that only public comments that are specific to a page and line number will be considered. In my opinion, the VVSG problems are so severe that it is way premature to inspect spelling errors. Until focused on the correct target, and using the correct ammunition, it is too way early to do any fine tuning.

Is there anything you would like me to do to amplify these points?

Thank you for conducting your hearing in Denver. I look forward to working with you.


Al Kolwicz
CAMBER - Citizens for Accurate Mail Ballot Election Results
2867 Tincup Circle
Boulder, CO 80305


Election System


Election Objects

Unused Ballot
Cast Ballot
Election Results
Control Data & Audit Report


Election Requirements

Requirement _____ Metric ______ Standard

Ease of use
Cycle time


System Standards


Election System Design Rules

  • “Using the computer industry as an example, Carliss Y. Baldwin and Kim B. Clark develop a powerful theory of design and industrial evolution. They argue that the industry has experienced previously unimaginable levels of innovation and growth because it embraced the concept of modularity, building complex products from smaller subsystems that can be designed independently yet function together as a whole. Modularity freed designers to experiment with different approaches, as long as they obeyed the established design rules.” from

  • "Process Synthesis, also known as Structured Conceptual Process Design, is a technique suitable not only for making a step-change in the existing process but also for synthesizing a process flowsheet from scratch.” From Process Design Center, The Netherlands



"We are fast approaching the stage of the ultimate inversion: the stage where the government is free to do anything it pleases, while the citizens may act only by permission; which is the stage of the darkest periods of human history, the stage of rule by brute force." - Ayn Rand, The Nature of Government


CAMBER is a dedicated group of volunteers who are working to ensure that every voter gets to vote once, every vote is counted once, and that every ballot is secure and anonymous.

Citizens for Accurate
Mail Ballot Election Results
2867 Tincup Circle
Boulder, CO 80305
Phone: 303-494-1540


Friday, September 23, 2005

Election Assessment Hearing Report

Thursday, September 22 marks the release of a Preliminary Report of Findings by the Election Assessment project. The 54-page report documents the wide-ranging concerns expressed by voters in testimony and submissions received at the public Election Assessment Hearing convened on June 29, 2005 in Houston, Texas.

Testimony and analysis presented at the Houston hearing represented voters of at least five major and minor political parties, and described numerous problems and irregularities in the conduct of the American electoral processes.

The Election Assessment project seeks to foster the use of established professional methods for the effective improvement of election processes by administrators, policymakers, standards bodies, advisors and other voting stewards and participants. Ongoing goals of the project include capture of the voice of the customers of the electoral process (the voters) and addressing the measurement of the process, the analysis of root causes for defects, and the controlled implementation of improvements.

The Election Assessment Hearing Preliminary Report is available online at

September 22, 2005
Contact: Seth Johnson
Phone: 212-543-4266

Thursday, September 22, 2005

Colorado Security plan deemed worthless

Colorado HAVA director.

We hope that by now you have dismissed Boulder County’s draft security plan as a joke. The four page “plan” with accompanying attachments is worthless. We hope that the Boulder County effort is not representative of the other county plans.

We suggest that you refer Boulder County to professionally developed security standards and papers including:

Security is a professional subject area, like brain surgery, and should not be attempted by amateurs.

Wednesday, September 21, 2005

Boulder County Election Plan Fundamentally Flawed

DATE: September 21, 2005

TO: Josh Liss
FROM: Al Kolwicz, CAMBER
CC: Linda Salas, Bill Compton, Hillary Hall, Marty Neilson,
Dean Schooler, Joe Pezzillo
RE: Draft Mail Ballot Election Plan, September 7, 2005

We have reviewed your September 7th draft Mail Ballot Election Plan, and confess to being terribly disappointed. Most if not all of the problems identified during the 2001-2004 elections have not been addressed.

There are fundamental problems with the plan. The plan is so incomplete that it is not meaningful for us to prepare a comprehensive analysis. The results from an election conducted under this plan should not be trusted.

It may seem odd to say this, but county employees have a huge vested interest in the outcome of this election -- future income and term-limits. Voters should not be asked to trust that those with the most to gain will conduct a trustworthy election. To the extent humanly possible, this plan should be sufficiently robust that error, fraud, or incompetence cannot escape detection and public disclosure.

1. The plan discloses that Boulder County intends to violate Article VII, Section 8 of the Colorado Constitution. This is a fundamental defect which will not come as a surprise to you. We have made many requests, beginning at least as early as August 2nd, for disclosure of the county’s plan to provide anonymous voting. You have chosen to hide your plans by not responding to these many requests.As you know, the county has a proven alternative to non-secret ballots – ballots with ballot stubs – that is compatible with the HART/Intercivic vote interpretation and counting system. We have requested that the Secretary of State disapprove your plan unless it is revised to provide anonymous voting. We ask that you do so.

2. Boulder County elections have suffered a pattern of major problems with Logic & Accuracy Testing, Canvass Board membership and operation, watcher’s access to election data contained in computer files, and even the interpretation of the meaning of words such as “cast”. None of these problems have been addressed in the plan.

3. An election conducted under this plan will not be transparent. The county has been presented with many examples whereby watchers have been blocked by election officials from performing watcher duties. Provisions for Boulder County Political Party participation is missing. There is no mechanism for publicly reporting and resolving election issues.

4. An election conducted under this plan will not be verifiable. The county has been presented with many examples whereby watchers have been blocked from verifying processes and records, including computer files, and from verifying the security, eligibility, interpretation and counting of votes.

5. An election conducted under this plan will not be secure. The county has been presented with many examples of security exposures including privacy issues, intimidation and vote selling issues, forgery issues, ballot control issues, and verification of computer systems, files and soft-switches.

6. An election conducted under this plan will not be accurate. The county has been presented with many examples of inaccuracy problems including the counting of ineligible votes, rejection of eligible votes, lack of batch integrity, and HART/Intercivic vote interpretation and vote counting reliability problems.

The county has chosen to conduct its planning in the dark, protected from the sunshine of transparency. It has ignored all offers of help and suggestions for improvement. The county has chosen to behave as “ruling elite” rather than “public servants”.

Despite its vested interest in the outcome, the county is proposing to conduct a non-trustworthy election. This is exceedingly bad public policy.

Delaying this election would provide time to correct the major problems. If you do not delay the election, there is something that can be done to improve the situation -- implement the August 2nd recommendations made to the Boulder County Commissioners:

Citizens ask Boulder County Commissioners to "act to restore public trust" –

If the problems summarized above are not fixed, or the plan to restore public trust is not implemented, we fear that the results of this election will be contested. This will not improve the public’s confidence in our election system.

Tuesday, September 20, 2005

Violation of Colorado Constitution -- voter privacy

Citizens for Accurate Mail Ballot Election Results
2867 Tincup Circle
Boulder, CO 80305

September 20, 2005

Gigi Dennis BY FAX 303 869 4860
Colorado Secretary of State
1700 Broadway
Denver, CO 80290

URGENT: Violation of Colorado Constitution – Article VII, Section 8.

Dear Ms. Dennis:

Welcome to your new position as Colorado Secretary of State. We wish you the very best, and we look forward to working with you in behalf of the voters of Colorado. Understanding that you are very busy, we’ll get right to the point.

Boulder County is planning to violate the Colorado Constitution during the November 2005 election. You have the authority and duty to prevent this. We ask you to enforce Article VII, section 8 of the Colorado Constitution.

You have been asked to approve Boulder County’s draft Mail Ballot Election Plan, dated September, 7, 2005, which discloses that paper ballots will be required to be used, and that each ballot is to be permanently marked in a way whereby the ballot can be identified as the ballot of the person casting it – page 9, paragraph-O.

This is a violation Article VII, section 8 of the Colorado Constitution which says, “All elections by the people shall be by ballot, and in case paper ballots are required to be used, no ballots shall be marked in any way whereby the ballot can be identified as the ballot of the person casting it.”

We ask that you disapprove Boulder County’s plan to so violate the Colorado Constitution.

We support the use of paper ballots. We object to the use of ballots containing non-removable unique identifiers such as printed serial numbers or identifiers encoded as bar-codes. Non-removable serial numbers/bar-codes are not legal. They can be used to facilitate vote selling, voter intimidation, and privacy invasion. The serial number/bar-code enables the government, an insider, an outsider, or the voter to identify a ballot as the ballot of a particular voter.

Boulder County’s expressed intention is to use the serial number/bar-code for ballot control, and not to associate voters and ballots. They do not express bad intentions. However, once the data exists, others may make the association between ballots and voters.

Boulder County has several options available to it that do not require use of a non-removable serial number/bar-code. One of these options would be to use removable serial numbers/bar-codes. Unique identifiers would be recorded on removable ballot stubs. The stub containing the serial number/bar-code would be removed before the ballot is cast by the voter. The stubs would be retained for use in ballot auditing in conjunction with a poll book that lists which ballot(s) were issued to each voter. This option would comply with the Colorado Constitution and with Colorado’s Election Laws and Rules.

Boulder County is on record as opposing ballot stubs because of the possibility that a procedural error might result in a ballot being cast with the ballot stub still attached – thereby associating the voter and their ballot. This is a fallacious argument for at least two reasons: (1) the November election is a mail ballot election and all stubs would be removed by election workers, and (2) the computer file containing the scanned ballot images would not contain the image of the original serial number/bar-code.

The Colorado Constitution is clear. “… no ballots shall be marked in any way whereby the ballot can be identified as the ballot of the person casting it.” Once cast, the ballot must be absolutely anonymous and indistinguishable from any other ballot of the same style from the same precinct.

A unique serial number printed or bar-coded on a ballot and not removed before the ballot is cast is a mark that can be used to “identify the ballot as the ballot of a person casting it” and consequently violates Article VII section 8.

We ask that you fulfill your duty and exercise your authority to prevent Boulder County from violating the Colorado Constitution.

Al Kolwicz
Executive Director

cc: John W. Suthers, Colorado Attorney General
Linda Salas, Boulder County Clerk & Recorder
Dean Schooler, Lead Plaintiff, Schooler v. Salas, Case# 2004CV1281
Hillary Hall, Chair, Boulder County Democrats
Marty Neilson, Chair, Boulder County Republicans