All posts by Harvie

About Harvie

CEO, StandbySoft LLC (StandbyDisk software for Japan business PC market) 2003–; Curator, Director of Competition, Interactive Media Festival 1994, Los Angeles; Co-chair, Colorado Democratic Party State Platform Committee 2006; Member, Colorado Secretary of State Uniform Voting System Public Participation Panel 2013; Member, Election Verification Network 2013-; BA-Cornell '74, MSEE-MIT'79

Wyden Klobuchar election bill introduced

Here are my comments on the Wyden Klobuchar bill. The Natural Disaster and Emergency Ballot Act was made available to the public March 18, 2020.

A copy of the bill text is available here.
(https://www.wyden.senate.gov/imo/media/doc/Natural%20Disaster%20and%20Emergency%20Ballot%20Act%20of%202020%20Bill%20Text.pdf)

The dedicated effort to write the bill deserves a few overview paragraphs from me followed by a list of opportunities missed and then inline suggestions for the text in the bill:

The COVID-19 threat is a serious one and more serious than the previous threat for which we have been managing risks, namely the threat of intervention by Russian agents. Responses to both seem likely to harm chances for verification – in one case because of additional security that probably impedes convenient access to election facts by the public and the other because the proposed responses dramatically end direct personal contact between citizens and their election process (and the camaraderie of voting).

I hope the bill will concern itself with a solution to an extreme situation that deserves temporary remedy rather than drive US elections permanently toward serving remote voters who never witness the election eligibility determination and tabulation process as they would have ata precinct polling place.

In Colorado (and Oregon) we are already familiar with the end of polling place voting and the extent to which this separates voters from tabulation processes and ends the celebration of election day widespread citizen involvement. We also know about attempts to spread out the period of time for voting as is called for in this bill. Officials had hoped in vain for a spread in the load of centralized tabulation but voters (for very good reasons) continue to vote near or on election day. We are also familiar with unattended drop boxes and the way they escape oversight while enhancing convenience and avoidance of an error prone USPS. Long periods of central tabulation also are a detriment to citizen oversight – such as the 14 days authorized by the bill.

The bill deserves commendation for taking a non-internet involved route for remote ballot return even as it allows internet delivery of ballot images to the voter to be machine or hand marked by the voter. Note this electronic delivery happens only upon voter request and only if the postal delivery of the blank ballot has failed by 2 days prior to the deadline.

In other words the bill constructively relies upon some form of physical paper for ballot marking (either mass-printed in advance and delivered by mail or remotely printed by the voter on whatever paper and device is available). That dependence upon paper is good because the voter will in most cases be able to have seen the marks on paper that represent the voter intent for the system that will receive the same paper the voter marked. (Obviously states like CO that already have electronic return will be alowing that, so the bill doesn’t produce uniformity of verifiable paper return.)

The mention of innovative techniques (all already implemented in Colorado) of early voting, drop boxes, remote ballot marking, automatic signature verification, ballot tracking) is exciting but of these only signature acceptance, verification and cure are provided a means in the bill to develop standards for quality and performance or audit that ought to exist prior to a nationwide rollout.

Colorado insiders will see the Colorado “modernized”election in this bill. Three things Colorado doesn’t already have are two forms of voter contact for cure followup or an appeal process for signature cure or postmark return. But almost all the deadlines in the bill are more difficult to implement than what CO has implemented.

Also the bill doesn’t implement Colorado vote centers other than what is needed for early voting. But early voting is a precursor to vote centers because it implements an electronic transaction for eligibility determination between the place the voter votes and a large database that keeps track to avoid multiple instances of voting. In some states this will probably represent a drastic shift of paradigm and likely impossible unless there is only one early voting location in the election jurisdiction or early voting is only by mail.

Colorado’s election has gone from almost every event watched by some voter at a precinct polling place ( such as is still standard practice in New Hampshire) to very difficult to watch at all even though more centrally situated. I am the citizen most likely to try to watch all elements of accessible election process in multiple counties in CO. I hope the Wyden bill doesn’t lower the expectation for public verification of election quality for all future elections. The bill desperately needs broader provisions for quality assessment and citizen verification of all its innovations.

Finally I should say that internet voting would be a disastrous choice to use to provide “social distancing” for our elections. I’m glad the Wyden bill does not promote internet transmission of vote selections.

Advanced readers interested in improving the bill may want to read further:
A list of omissions or opportunities missed that I noted in the draft bill:

Transparency: Nothing here to provide for public access to verify eligibility determination done by signature verification. All signature verification should be subject to offline review with appropriate non-invasive citizen access to assess quality of decisions to approve or reject and trigger corrective action.

Signature verification and any other eligibility determination for remote voting needs to become part of the voting system so that EAC testing and certification applies to it. Perhaps the NIST focus on signature verification in the bill will lead to this conclusion.

Privacy concerns: No mention of means to avoid violation of voter privacy either by officials or by public

Nothing here to deal with ballot design such as beneficial layout and pagination standards and system design for handling ballots such as using a privacy protecting batching strategy or use of sensible remedies for substantive identifiability of stray marks on ballot sheets voted at home.

No mention of importance of the process of separating the identity of the voter from the voter intent.

This bill could add an option for a statewide or regional return of mail ballot packets and implement a highly centralized high speed process for tabulation with excellent oversight from the public including local officials who would demand sufficient access and accountabiity from the central processing facility.

This bill could also arrange for mail ballot tabulation to be given 24 or 48 hours of patient and complacent process after election night before results are allowed to be reported to account for the special side effects of an emergency condition such as anticipated here. This could have been the most helpful provision of the bill.

NIST I hope will establish a working group consisting of advocates and academics and officials (similar to the VVSG working groups) to iron out the many nuances here that will have a resounding impact on VBM when it increases in volume dramatically as a result of this bill if it comes to fruition.

Here are inline comments ( I have simply cut and pasted portions of the introduced bill:

page 8
21 ‘‘(4) the State permits any eligible voter to have
22 the option to request an absentee ballot for subse
23 quent elections on all absentee ballot requests;
24 ‘‘(5) the State does not require any form of
25 identification for an absentee ballot request;

(4 above) This is a permanent absentee check off This implements a mass transition to vote by mail that is a crucial policy shift. It isn’t appropriate for an emergency measure like this. The permanent absentee checkoff creates a rachet that might make precinct polling impractical as it did in Colorado.

(5 above ) This is a drastic limitation on any future attempts to provide integrity and verification in eligibility determination and it reads as partisan. Some identification method is needed otherwise anyone can apply to send anyone an absentee ballot.

page 9
1 ‘‘(6) the State does not include any require
2 ments for notarization or witness signature or other
3 formal authentication (other than voter attestation);
4 ‘‘(7) the State permits voters to submit an ab
5 sentee ballot by dropping it off at designated loca
6 tions before the close of polls on the date of the elec
7 tion, including at any polling location on the date of
8 the election before the close of polls;

(6 above) Too drastic – how will the validity of the request be determined? Can anyone request an absentee ballot for anyone else?

(7 above) Unattended dropoff involves a serious loss of chain of custody and verification of the casting moment. This may encourage mail ballot packet harvesting. Drop locations deserve attendance by election workers or intelligent sensing of the activity of the insertion and who is performing it. Unattended dropoff should not distract voters away from attended voting locations except in the rare case of an emergency. Once the drop locations are in place, they will naturally attract voters away from an interactive experience in future.

20 ‘‘(B) does not put any limits on how many
21 voted and sealed absentee ballots any des
22 ignated person can return to the post office, a
23 ballot drop off location, tribally designated
24 building, or election office; and

(B above) No limit on number of return packets to harvest seems a bad idea. Colorado has a limit of 10 but it is unenforceable – in fact any unattended drop off opportunity makes such a requirement unenforceable. Nevertheless it is better to have a numerical limitation on drop off and provide a way to enforce it (such as technical facility within the drop box to detect the number of envelopes dropped and record activity near the box.

page 10

1 ‘‘(9) the State permits any eligible voter that
2 submits a request for an absentee ballot to vote in
3 such election, but does not receive their absentee
4 ballot at least 2 days prior to election day to
5 download and mark at home an absentee ballot pro
6 vided by the State pursuant to section 103C of the
7 Uniformed Overseas Citizens Absentee Voting Act or
8 section 322 of this Act.

(9 above) Not well enough thought out. Is this two day deadline to be monitored by the voter? Will the downloading of these remote printed ballot sheets begin two days before the deadine? That sounds like a support nightmare. As well it is a dupication nightmare if the ballots printed at home are to be machine tabulated. Better these voter-printed ballots are tabulated by hand.
13 ‘‘(1) if it is postmarked, signed, or otherwise in
14 dicated by the United States Postal Service to have
15 been mailed on or before the close of polls on the
16 date of the election; and
17 ‘‘(2) received by the appropriate State election
18 official on or before the date that is 10 days after
19 the date of such election.

(1 above) Postmark spreads out receipt of ballot packets after election day and is a detriment to timely election reporting, chain of custody, auditing. A postmark enabled late return means many of the judgement calls involved in eeligibility and tabulation (both signatures, marks on ballot sheets) will be done with knowledge of the partisan margins. Postmarks add another judgement call that can lead to bias in elections.

(2 above) 10 days is too long. San Diego CA uses 3 days. The longer it is the more likely voter privacy will be harmed and election night results will be inaccurate for lack of significant numbers of ballots to report on election night. Audits are also delayed. Late arriving ballots that are tabulated separately tend to create shifts in outcome that lead to questions.
22 ‘‘(1) IN GENERAL.—The requirement described
23 in this subsection is that the State begins processing
24 and scanning ballots cast during early voting or

page 11
1 through vote by mail for tabulation at least 14 days
2 prior to election day.

(1 above) 14 days is like Colorado. This time frame makes elections much harder to observe at central count facilities. Ideally ballot packets would not be opened until election day. That allows for a patient and verifiable signature verification process to proceed and not be rushed by the imminent commitment to tabulate each packet as it arrives. 14 days for eligibility determination, 1 day for scanning and 0 days for tabulation is best. The inclusion of “for tabulation” suggests the tabulation may proceed before election day. Of course it is important to define tabulation and if it involves producing vote totals it should not be allowed prior to the end of election day polling times.

page 22
14 ‘‘(1) In completing the ballot, the voter may
15 designate a candidate by writing in the name of the
16 candidate or by writing in the name of a political
17 party (in which case the ballot shall be counted for
18 the candidate of that political party).

(1 above- name of candidate) Unless the tabulator has automated support for write-in, this requires duplication or remaking in order to machine tabulate. This will create a massive slowdown if many home printed ballots are returned and machine tabulation after remaking is required.

(1 above- name of party) This looks like a policy change. The writing of the party name will cause tabulation difficulty unless it is handled as a standard write-in on a machine tabulated ballot. If the party write in is offered with a whole ballot scope, overvote issues arise with respect to other conflicting choices on the ballot separately expressed.
19 ‘‘(2) In the case of the offices of President and
20 Vice President, a vote for a named candidate or a
21 vote by writing in the name of a political party shall
22 be counted as a vote for the electors supporting the
23 candidate involved.

(2 above) This might beneficially be limited to only cases where the centrally pre-printed ballot is unavailable. But how to monitor that? This is an expense nightmare in the making. Perhaps this can be handled as a newly legalized form of write-in (party name in place of candidate name).

Page 38
7 ‘‘(2) FORM OF NOTICE.—An election official
8 shall provide the notice required by paragraph (1) by
9 at least two of the following methods:
10 ‘‘(A) Regular mail.
11 ‘‘(B) Phone.
12 ‘‘(C) Electronic mail.
13 ‘‘(D) Text message.

(2 above) The two forms of notification look innovative and a good idea if there are two means available. It is important that voters are treated equally and this may not be possible. With large numbers of voters by mail, truly absentee voters tend to be treated worse because they may not receive the notification of the opportunity to cure.

Page 39
9 ‘‘(ii) if such confirmation or informa
10 tion is rejected, to appeal the rejection;

(ii above) This presents real problems for certification deadlines and will also create a chaos of quasi-judicial hearings of some kind. Not a good idea. Transparency over the process to keep quality standards high is a better way.

15 ‘‘(C) ‘prior to the date of final certification
16 of ballots in the election by such State, to pro
17 vide such individual a final determination as to
18 the validity of the ballot and whether the indi
19 vidual’s ballot was counted in the election.

(C above) Thisonly aggravates the impossibility of the appeal process mentioned above. If the notification must take place it should be after certification with no recourse or it should be soon enough to allow recourse. If it is just a second warning about the opportunity to cure, it is pointless.

Page 41
10 ‘‘(e) RESEARCH AND DEVELOPMENT.—The Director
11 of the National Institute of Standards and Technology
12 shall expand the research and develop best practices or
13 guidelines for the acceptance, verification, and curing of
14 signatures for mail-in ballots.

(e above) This is a wonderful provision that will focus technical attention to quality assurance for mail ballot eligibility determination for all states using it regardless of any exceptional condition. I hope NIST wil realize that transparency and oversight is a key to any best practice for verification of signatures.

Page 52
9 (3) Costs of implementing requirements with
10 respect to availability of voting prior to election day
11 pursuant to section 321 of this Act.
12 ‘‘(4) Costs associated with purchasing addi
13 tional and upgrading high speed ballot printers,
14 inserters, ballot sorters, envelope extractors, and
15 scanners to send and process absentee ballots and
16 costs associated with purchasing ballot drop boxes.
17 ‘‘(5) Costs associated with the development or
18 purchase, implementation, and use of technology to
19 allow election officials to electronically verify a vot
20 er’s signature on a ballot envelope against a voter’s
21 signature on file without physically handling the en
22 velope, provided that the technology is not connected
23 to the internet.

(3 above) Costs of implementing the early voting with epollbooks or statewide registration database could be very high in some states.

(4 above) The cost of ballot drop boxes ought to include the cost of technical or human oversight for them- not just a camera on a distant lampost or building wall but a scanner and camera in the box to account for what is inserted and who inserted it.

(5 above) Eligibility determination equipment ought to become part of the HAVA definition of voting system and then must become part of the tested and certified equipment. The provision to prevent connection to the internet is a very constructive positive here.

Page 53
3‘‘(7) Costs associated with developing or pur
4 chasing secure accessible remote ballot marking sys
5 tems for use by voters with disabilities, provided that
6 such systems do not cause the voter’s ballot selec
7 tions to be transmitted over the internet and do not
8 allow for the electronic submission of a marked bal
9 lot.
10 ‘‘(8) Costs associated with developing or pur
11 chasing and implementing signature verification
12 software.

(7 above) It’s good that this text dissuades vote selections from transiting the internet and avoids electronic submission.

(8 above) Once again, costs are provided without any regulation to establish and maintain standards for quality. Signature verification systems have not undergone significant testing and auditing methodology has not been well developed.

Harvie Branscomb harvie at electionquality dot com 970-963-1369 3/18/2020

Suggestions for improvement of Colorado elections

Suggestions for improvement of Colorado elections by Harvie Branscomb 6/1/2019  harvie [at] electionquality.com  6/2/2019  http://electionquality.com

In Colorado several conditions have changed in the last twenty years that merit consideration and accommodation in election methods through substantive improvements – 1) the precinct polling place has been eliminated, thus separating the citizen voter from ability to observe the election process, and 2) the voter is no longer present when his/her eligibility is determined and 3) the ballots are no longer sorted by precinct and this has impinged on ballot anonymity. Finally, 4) voting systems now provide the possibility for interested citizens to access copies of the election records through images and cast vote records. The age of the evidence-based public election has begun and Colorado is leading the way.

On the way to a publicly verifiable evidence-based tabulation we are well into implementing the Risk Limiting Audit. This audit once completely implemented and supported by public access to election records will likely end concern about election outcomes that are wrong for reasons involving tabulation. This will have been a remarkable achievement. We are not quite there yet. At present our Secretary of State is choosing what to audit, our statewide contests aren’t fully auditable, our cast vote records are being summed by software for the audit but the cast vote records are not available to be checked. And our ballots, images and cast vote records are not entirely anonymous, even though the Colorado constitution requires this.

My suggestions below are motivated by the desire to credibly achieve the evidence-based public election that enables a public audit of election outcomes:

To achieve substantive ballot anonymity

Pay closer attention to the necessary clear separation between the identifiable-voter eligibility phase and the anonymous-ballot tabulation phase – this is a general guiding principle. Particular attention must be paid to the places where these phases overlap, if at all. For example, the deconstruction of envelopes containing two ballots from U voters in primaries where the voter did not affiliate or state a preference is an overlap situation that requires attention. Counties have invented several different methods to maintain a verifiable separation of the identity from the anonymity phase.

End the identifiability of approved/tabulated provisional ballot sheets by making them identical in form and style to regular ballot sheets – no special marking indicating the formerly provisional status. This can only waste time and money, create special inventory and most importantly, risk voter privacy.

Set a legal standard for a threshold of substantive self-identification on a ballot sheet that requires duplication or redaction – set guidelines for how that redaction would be done such that it can be done by bipartisan election judges at the time of opening and in a manner that is reversible under court order. For example, using pressure sensitive redaction paper. This will help protect counties from law suits.

The 2017/18 cleanup bill called for rulemaking to protect voter privacy – meaning anonymity of ballots (in the section that ended the requirement for the secrecy sleeve). I hope to see discussion of what those rules might look like – e.g. use Opex, camo pattern printed in envelope, all voter ID on one side of envelope, more effective disassociation of envelope batches from ballot sheet batches, combine and mix ballots from multiple vote centers to prevent rare styles, reduce rare styles during redistricting and re-precincting, choose coordinated contests designed to protect voter privacy, define substantive self-identification of ballots (mentioned earlier), etc.

To achieve more verifiable accuracy in eligibility determination and the act of casting the ballot:

Improve signature verification – enable SCORE to prioritize signatures based on provenance and age of signature. ( e g. recently signed in-person by pen on paper in presence of an official would be prioritized first) – collect timestamps on sigver decisions to allow review of quickest or slowest decisions and decision reversals that took a lot of time – simplify uploading of undeliverable images – standardize SCORE interfaces for sigver with better human factors and less observable PII for election judges, supervisors and watchers.

Build UOCAVA privacy, oversight and accountability. Require testing of new technical methods for securing and reporting ballot delivery and return for UOCAVA – mindful of encroaching risks of internet voting. SB-19-202 requires a very cautious implementation.

Enhance drop box oversight and accountability – votes are lost due to naked ballot drop-off – return to a definition of “cast” that involves a voter action – look toward automated binking, reporting and rejection of improper envelopes at 24 hour drop boxes.

To achieve better contact and mutual familiarity of voters with the election system:

Encourage voters about to drop a signed ballot packet into a drop box at the door of an open VSPC to return mail ballots in-person inside the center and avoid the need for subsequent central count signature verification and opening processes ( e.g. deposit home marked paper into an election judge monitored VSPC ballot box after a simplified check-in and signature confirmation in front of an official. )

To implement practical access to election records by interested parties:

Implement statutory positive and timely public transparency of voted ballots, ballot images and cast vote records in Title 1 as a deliberate route to build public confidence – Alternatively, adjust CORA so it does allow access to voted ballot data early enough so the public can either participate in or verify the audit in time for a decision to recount. Public access shouldn’t treat all instances of CVRs, images and paper ballots alike – they have very different technical specifications and risks and defenses regarding ballot anonymity. The conflation of all three types of records, and the arbitrary requirement to use CORA to obtain access is an obstacle to election transparency and specifically the functionality of the new RLA. The best solution is to add election transparency into Title1 as a normal public benefit administrated by the SOS.

To complete the implementation of the RLA and integrate it with recounts and NPVC:

RLA implementation details: Provide for the RLA to be conducted in public with reports written by counties to include descriptions of exceptional expressions of voter intent, to be published by SOS as in the previous audit law. Also provide for independence selection of contests, transparency of audited records, proper way to describe, etc.

Rationalize the recount law to match other states formulas (1/2 percent of all ballots accepted containing the contest in the election) and to accommodate it to make sense with the existing RLA (this has only partially been done in Rule).

Encourage actual verification of voter intent on machine-marked paper ballots – improved layout and process at VSPC to motivate actual check of the contents of the paper before depositing paper in ballot box.

The National Popular Vote Compact (NPVC) has passed into CO law. Colorado ought to play an important national role to explain the potential impact of recounts and audits that vary state by state on the NPVC. Options by states to recount will make it difficult to obtain a static final national election result by a deadline. Colorado may be best prepared to suggest enhancements that could be enacted by modification to the compact, or introduced as federal law to implement a national risk limiting audit that could stand in for a national recount in case of a narrow margin election.

To simplify styles and balancing, and to make process more efficient and realistic

Allow optional independent setting of ballot style for individual ballot sheets within multiple sheet ballots.  Allow counties to paginate contests onto multiple sheet ballots intelligently – to place statutory districts on one sheet and coordinated districts on a different sheet and tabulate and account for them as independent styles. Existing multi-sheet elections using this method will see improvements in anonymity/voter privacy especially when ending precinct reporting for special, school and municipal contests. Districts whose borders ignore precinct borders create precinct splits. When these special, muni and school districts are no longer precinct reported, precinct splits will go away, much simplifying the election.

Allow counties to report and canvass boards to balance elections by comparison of 1) style-specific SCORE reports of voters getting credit for voting with 2) a count of sheets tabulated by style using cast vote records as the source ( no need to have voter intent shown in these CVRs). Eventually voting systems will no longer attempt to report “ballots cast” but rather “sheets tabulated” by style, where each voter may have received two styles.


Clarify the use of words such as “cast,” “ballot,” “image” and the like in VVSG to be suitable for remote voting, central count and RLA. Colorado has much to contribute to that discussion that would bring VVSG 2.0 into the future rather than focused on the past. I hope to see more CO involvement in VVSG discussions before they are put to bed. Colorado’s existing innovations may not yet be adequately included.