I prefer the scantron type of voting since it creates an  audit trail for verifying votes. Electronic may or may not have an appropriate re-count ability. Electronic devices also can have cybersecurity issues.

I have no clue what the problem is.  I prefer electronic voting and expect the Board to provide secure voting for the public.

You cannot expect the public to take responsibility for cyber problems.

Make the electronic voting secure, plain and simple.  Duh!

I believe that the Scantron system has worked just fine up to this point and unless there are serious concerns about accountablity and security with the Scantron system that Virginia stick to what works.

I prefer voting with a paper ballot.  Once marked it remains available for recounts should one of the reading/counting machines fail or be shown to not be working properly.

I do not trust other forms of recording votes.  I believe any equipment which which uses wireless networking, even if encrypted, leaves open the possibility of hacking and thus vote tampering.

The Voting Equipment Audit Report

This report prepared by Pro V&V, dated March 12, 2015, was alarming and provocative but inconclusive.

The auditors physically examined 27 AccuVote TSX machines in Virginia Beach and found all had issues of eroded capability due to age. This is valuable data but there is no actionable rating of EOL expectations that localities can use.

In Henrico County, where a “high level of anomalies” had been cited in the November 2014 election, the auditors were unable to examine any AVS WINvote machines because of an impending special election. Conclusions were offered that were not specific to Henrico’s machines and this data is not valuable. In my opinion, there was no audit here.

In Spotsylvania County, where “a high level of anomalies” occurred in Precinct 302 in November, 2014, the auditors tested “four spare machines” rather than the actual machines which had been in use in Precinct 302. In my opinion this is not a valuable comparison and not an audit.  The auditors also declared that they were able to “connect” to the WINvote wireless network with their cell phones but there is no allegation they were able to transmit data in either direction, nor to crack the encrypted code on the WINvote DREs. This is a technical area beyond my expertise but I see no evidence from the auditors that they were able to do anything more serious than determine from their cell phones that a wireless network was active in their immediate vicinity. If there is more to it, we need details.

ELECT’s Interim Report

This report offers details of the Spotsylvania County issues in Precinct 302 including the allegation of a smartphone streaming music from the public library wireless network being the primary suspect for WINvote DREs “crashing” in succession. These actual voting machines have now been turned over to the State Police for examination in a formal inquiry. It will be very instructive to learn whether this anomaly can be replicated and whether the encrypted data on these machines was at any time vulnerable to alteration or erasure.

The results of this formal investigation should provide actionable data for the State Board of Elections. Without empirical proof of actual failure or open vulnerability to result manipulation, any action to de-certify WINvote DREs would be reckless, and the damage to the integrity of the elections community would be incalculable. The cost to affected localities would be severe.

The recommendations for substantial improvement in the ability of the Department of Elections to conduct comprehensive audits, regular certification review, and thorough post-election analysis is well founded and long overdue.

I applaud the Department for its investigation and for the transparency with which it is being conducted. Please continue to move with caution and deliberation on this most challenging time.

The City of Fairfax Electoral Board has grave concerns in regard to the recent actions of the Department of Elections directed towards WinVote voting equipment. Specifically, the Department of Elections has unilaterally decided WinVote equipment does not meet the needs of all localities and the voters of Virginia, and with little notice, announced a public meeting to discuss a flawed Interim Report on DRE voting equipment and the certification status of the WinVote system. It is clear the intent of the Department of Elections is to decertify the WinVote equipment.

The studies and surveys of WinVote equipment directed and just made available by the Department of Elections are significantly flawed.  It appears the Department of Elections decided the investigation of voting equipment would ignore the manufacture of the WinVote equipment and localities which have a continuous positive experience with WinVote equipment. To state the concern clearly, the City of Fairfax Electoral Board believes the Department of Elections has unilaterally decided to decertify WinVote equipment and to support that predetermined result, has selectively extracted from Department of Elections directed audits/studies and surveys "findings" to support that action.

The infringement on localities by this aggressive move by the Department of Elections to decertify WinVote equipment is unprecedented. The fiscal impact on localities will be significant. The Department of Elections is aggressively moving to solve a problem that does not exist in the City of Fairfax or other localities which have repetitive, positive experiences with WinVote equipment.

An undated Interim Report on voting equipment performance, usage & certification conducted under the auspices of the Department of Elections appears more focused on a different agenda (obtaining additional staff for the Department of Elections) than presenting an objective analysis of WinVote equipment.

Having served as an Officer of Elections, Secretary of the Electoral Board, and Precinct Chief for a number of elections over the past decade or so, I think the WINVOTE DRE voting machines are very good.  They seldom have problems and when they do they are very easy to re-boot and no votes are lost.  When we close down after a day of voting, WINVOTE DRE gives us multiple copies - by machine and by location - of the votes cast on the machines.  If our WINVOTE DREs are decertified, we'll have to spend additional money and re-train 30-50 OEs.  Why do that?  We already have good machines and knowledgeable OEs.

Respectfully,

Jim Brown

I am frustrated that some Localities did not take the advice of State Officials to disable the WinVote Wireless feature in 2006 and now the Department of Elections is considering decertifying  them and could cost my Locality approximately $300,000. I realize the machines are old; however, there is a simple solution, but more work is involved!! Honest, fraud free elections should be top priority for all of us!!  You have the authority to mandate that all WinVote machines be programmed to produce a single report of votes.  Just disable the Wireless feature.  I hope you do not mandate the replacement of these machines without providing the necessary funds to do so. Governor McAuliffe, the best Governor we have had in many years, saw a need for new voting equipment, and he certainly had the right idea when he felt that Virginia needs only one Voting Machine Vendor!!    .

Used the Winvote system at the last election and it worked well.  My wife and I both felt confident that our votes were accurately recorded.  It was quick, logical and easy to use.  We do not understand the eagerness on the part of the board to remove these machines and start the use of another type.  If it isn't broken, then don't waste time and money trying to fix it.  These machines, at least from this user's perspective, aren't broken.

Thank you.

F. Kneisel

The WIN system has worked well at our precinct and is simple for all to understand and use...even the computer illiterate generation. Unless there is a more elaborated electronic system to replace this one, I say say "Leave well enough alone!"   Going back to paper, as some suggest, is going back in time, is antiquated and time inefficient.  The WIN system may be aging, but still works well. Hackers in the electoral system have not proven to be a problem, but any system used can be compromised.  I vote for leave the system intact!

We use a "scan-tron" type voting apparatus in our King George precinct.  The voter marks a paper ballot with a marker and feeds the marked ballot under witness to the tally machine.  It provides an electronic tally of votes cast but also (most importantly) retains the paper ballot used.  I find the ballot set-up easy to understand and use as well as being unambiguous.  If a voter commits an error, he/she can request a replacement ballot prior to casting their final official ballot (the ballot in error is destroyed).  Votes can still be cast in the event of a power failure. 

Yes, all electronic machines can provide greater efficiencies but having a physical paper ballot as a last resort for accountability is an excellent hedge against any fault that may come with a software based apparatus.  I feel having that paper ballot in a secure container provides a sense that my vote is there and ready to be counted in case the apparatus itself fails or comes into question.  The beautiful thing about paper is that it requires physical access and alteration or destruction to become compromised, regardless if the apparatus itself fell into an error state or was compromised electronically.

Not so with electronic machines not hardened against cyber-attack and come with a built-in vulnerability.  It defies basic security precepts having a voting apparatus with wireless capability.  The function of these machines is comparable to that of any critical infrastructure element in our society.  They must have the ability to record and tally votes in a means above reproach.  Having the ability to be remotely accessed automatically renders them suspect given the level of sophistication demonstrated by various cyber criminals to date.  This vulnerability is a glaring red flag and a cause for grave concern.  Just because something has not happened so far does not mean that something cannot happen.  Absence of evidence is not evidence of absence of a vulnerability.  How any community overlooked this aspect of their voting system is baffling.  To me this represents a major failure of due diligence of the governing agency(ies) to properly assess and address all risk associated with a particular apparatus proposed for use.  This is in addition to the other aspects of the system which are subject to compromise, disruption, or failure, such as the USB based flash memory.

The question put before the SEB is whether or not we should be using this particular voting system, which is open to attack and compromise by virtue of its design.  I think due diligence on behalf of the SEB requires them to assess the wireless capability as a grave vulnerability and decertify the system.  I understand this would upset a good many folks and agencies, but as a voter I would want my state and local governments taking appropriate measures to ensure that the voting process is secure from deliberate or inadvertent compromise.  Sunk cost is nothing compared to the integrity of the voting process.

With all due respect to the examiners who have been selectively checked a small fraction of the many Winvote machines that have faithfully counted the will of the Citizens of 20 some percent of the voters of our Commonweath for years prior to my first official experience with them 10 years ago (many more as a voter), I have found the system to be as a whole reliable and fairly easy to work with and to explain to the Public. 

It seems to me that having a dedicated and well trained staff - both professional and we poll workers is a large proportion of ensuring that the voting Public has a satisfactory experience on any Election Day , whether Primary or Presidential. Officer Training is  primary to the folks in the Registrar's office in the City of Fairfax.

As to the "new" system of paper ballots, I was very surprised to learn that because of the requirements of the Federal ADA the City and other jurisdictions will have to purchase WINVOTE type machine to fulfill it's requirements. 

If one system is troublesome a combination of two can only geometrically increase the complexity of elections for everyone concerned.

I have seen and used the machines and set them up as an officer of the elections.  The platform worked with great reliability and was easy to explain to voters. 

According to the AP press report 0f 4/2/15, electoral board's hired testing lab reported, "the WinVote system’s wireless capability makes it susceptible to a security breach. The investigator who was given access to a WinVote machine that was not used in a Spotsylvania County precinct was able to use his smartphone to connect to the wireless network hosted by the machine, according to the report."   My questions are,

1. Why was the WinVote system broadcasting its wireless ID in the first place for hackers to connect to it?
2. Why was the investigator "given" access so he could breach the system?  Was he also "given" Login information (user/pass) etc?
3. Why was the system broadcasting its ID so hackers can see and connect to?  Seeing a network is not sufficient for successful hacking. A hacker will also use sniffing tools.

In any event a lot of this can be mitigated by some some IT security controls.  Platform change is a rather drastic step.

Regards

Thank you for the opportunity to comment on WINVote Certification.

I have voted in Virginia since moving to the commonwealth in 1980.

In my mid-30s, my eyesight declined to the level that I could no longer read the screens in the voting booth.

I was unable to vote independently, much to my frustration.

Over time technology was developed, eventually allowing me to vote independently in Arlington County, using the touch screen machine.

With only one exception, I have had no problems.

The one exception occurred in 2008 and I was able to replicate the problem at a later date before members of the Arlington election Board.

However, I was told that this error would not likely be resolved and to my knowledge did not occur again.

Whatever decision is made by the Virginia board of Elections requiring Arlington and other jurisdictions to purchase new voting equipment, the board should require that:

1. The voting equipment be certified as accessible to blind and low vision voters.

2.  Workers at the polls on election or primary day be trained on the accessibility functions of the machines.

Experience by me and other blind and low vision voters has shown that, even with the best of intentions, workers are sometimes unaware of the existence of accessibility features of voting machines, or are unaware of how the machines must be set for blind and low vision voters to have independent access to the machines.

Although I am not speaking for the Old dominion council of the Blind and visually Impaired, the Virginia affiliate of the American council of the Blind, I have been a long time member and our members have worked with local election boards, especially in the Northern Virginia area, on issues related to accessible features of voting equipment.

Our Northern Virginia chapter has been pleased to have representatives from the Fairfax and Arlington boards speak at past meetings and demonstrate equipment.

In October, 2014, representatives of the Fairfax county election Board demonstrated the voting machine manufactured by ES&S, and allowed attendees the opportunity to practice using the machines.

This was especially helpful to those who voted in Fairfax County in November.   Members reported successfully voting, independently.  Some voted for the first time with no assistance.

It is a feeling that I can't express in words, but as someone who once could vote independently, then could not, I know first-hand how wonderful it feels when existing technology is properly implemented to improve lives.

While I do not endorse this specific machine, or any specific machine, I do highlight the need for the Virginia Board of Elections to mandate that all local election boards in the Commonwealth be required TO purchase voting equipment THAT contains accessibility features guaranteeing blind and low vision voters their right to vote independently.

I also offer to volunteer to test equipment being considered.

Thank you.

-Paul

Paul D’Addario

Arlington, VA

I have served as an Officer of Election for the City of Fairfax for more than fifteen years. My experience with the WinVote machines has always been positive. The machines enable people to vote clearly and quickly; and even people with no computer experience are able to vote with little or no help. I had the opportunity to witness the most recent statewide recount in both the City and County of Fairfax and what I saw was absolutely chilling and, in my humble view, a threat to democracy. While the recount for the City, admittedly a much smaller jurisdiction, was orderly and neat, the recount activity for the County was utter chaos, with court clerks rolling cart upon cart of scanned votes and dozens of people physically checking each card with coats and purses piled on the floor and on tables.  Each of those examinations opened the possibility of damage, loss or miscount.  The cross-check of WinVote machines ensures that every vote is counted in an accurate and orderly manner.  Please listen to those of us who actually work with the machines on election day and allow them to continue to be used.  Thank you for your consideration of my comments.

The study seems to be a good beginning, but not a final conclusive one. The two problems verified are susceptibility of the WIN Vote's wireless capability and calibration issues affecting performance of two Accuvote TSX units. These findings point to the need for more study, but certainly not for decertification at this early time. 

As an interim measure, WIN Vote units in polling places with wireless networks should be used as individual units and have their wireless capability disabled. In addition, any other DRE units showing calibration issues severe enough to affect performance (as the two units in Virginia Beach showed) should be removed from service. These measures should still allow for proper administration of the primary elections in June. 

For the longer term, more study clearly is needed. The report concluded that all localities in question should "begin planning for the replacement of these systems." It is my understanding that all localities in Virginia are either in the process of replacing DREs or are planning for such replacement. It is unfortunate that the Governor's recommendation for state funding to offset the cost of new equipment was not enacted. Local governing bodies need to be made aware of the critical need for funding of equipment, and ELECT needs the proper funding to conduct the necessary studies and to support the localities in their acquisition and implementation of new equipment. 

I regret that I am unable to attend the meeting in person and appreciate having the opportunity to submit this written comment. 

Please get rid of these inaccurate machines once and for all!

We cannot continue to jeopardize voter confidentiality using machines that will never be hack-resistant, and that do not give us the ability to recount votes accurately, if needed. We must stop flushing hard-earned state treasury funds down the toilet for voting machines.

Virgina should move to reliable precinct based optical scan machines.  Optical scan machines allow the results of the scan to be confirmed by recounting the paper ballots.  Paper ballots also sped the electronic process because the number of voters is not limited to the number of electronic voting machines.  Rather, the number of "voting booths" may be expanded inexpensively by expanding the number of privacy screens. A number of studies have confirmed that electronic voting machines are hackable.  It is difficult to prove or disprove hacking during an actual election, but the risk exists and could be avoided by changing to precinct based optical scan machines.

Any machine expected to record votes made by legal residents must be secure from tampering whether it be physical or electronic tampering, and there must be a paper record available for recount audit.  This is not the case in Norfolk.  There are no paper records on the Diebolds.  And they run on Windows CE which is easily hacked from what I've read.

I'm sure you have read about the wireless vulnerability of the Winvote machines too.  My personal assessment post Snowden, GET RID OF THESE MACHINES as soon as possible and make our Registrars work for a living like they used to with paper ballots.

I was a party observer during the recount of votes for Attorney General in Fairfax county in 2013. That was a close election and the outcome did reflect the effect of the recount. Without physical, paper ballots, that would have been impossible.

Electronic machines are a needless complicating factor introduced into a process that already works, and has none of the reliability nor security issues that computerized equipment always has. In particular, as convenient as wireless connection might seem, there is absolutely no inherent reason why a voting machine must, or even should, communicate with anything by radio. Polling places never need more than a few machines of any kind. Examining them individually takes minimal effort and requires less complex technology. If we must replace paper with electrons (and I say we shouldn't even be doing that), adding any kind of wireless feature to that process is an absurd and pointless undertaking of risk.

Please keep the paper, and dump the computer.

We have known for many years that the DRE machines don't provide the level of security needed to ensure votes are not changed or lost, accidentally or maliciously. They give the appearance of secure, advanced technology, but not the reality. The latest incidents and this review confirm that it is time to retire these old machines. Paper ballots with scanners are simple to use, more secure, and practically emilinate long lines to use the machines. 

It is time to do away with electronic voting machines (such as WinVote) and shift entirely to optical scan machines.  I have observed numerous elections, including the after-closing counting and an election recount,  The optical scan machines have been reliable and provide a critical paper trail.  They are also easy to use.  In my experience, some voters used the electronic machines out of habit in recent elections, but, given the choice, most voters used the optical scan machines.  I heard no complaints about them.  They have the advantage of being faster to use because more voters can complete ballots at the same time, without being limited by slow individuals in a limited number of electronic booths. Scanners have to be cheaper than electronic machines, as well. Most importantly, the optical scan machines are reportedly less subject to error and manipulation.  Accuracy is critical. 

The following comments are submitted on behalf of the Electoral Board and General Registrar for the County of Floyd.  We request that our comments be considered in the deliberations.  Amy Ingram, General Registrar, will be in attendance at the public hearing. 

If the primary concern in regard to WinVote reliability is the security of the machines from wireless access, then the solution is to disengage the wireless feature.  The wireless feature is used to collate the election results from all machines onto the master machine.  The wireless feature is not necessary to the conduct of an election – it merely makes it easier to tabulate results. 

Turn off the wireless feature and manually calculate the results from each machine, and the security concern is solved.

Officer training and the response capacity of Electoral Board members are also important factors in machine performance.  The manner in which problems are addressed can impact voter confidence just as the status of the machine can.  We are not surprised that a competing wireless system may have interfered with WinVote operations.  We experienced a wireless failure upon setting up machines in one precinct where communications systems are present that we suspect may cause wireless interference -- but the machines were otherwise functional.  Our machines operated normally during the election process, and we thought we would be manually tabulating at the close of the election, but in the end the wireless functionality became responsive. 

We believe that the knowledge and skills of the equipment operators are fundamental to troubleshooting and the successful operation of the system.  Our understanding is that the testing performed to support the decertification threat was performed without changing the wireless setting, and without much, if any, WinVote-operational expertise. 

Voter confidence also can be impacted by an ill-planned equipment change.  We will not be conducting a primary in Floyd, and cannot imagine being thrust into the position of the localities that must find an alternative means to conduct an election in less than two months.

Some of our WinVote machines are showing signs of aging electronics, and we are working with our local government to fund the purchase of new voting equipment.  Our locality is in the process of securing a loan for capital improvements generally, and it’s a hard pill to swallow.  

In the 2013 general election, one of our board members went to another locality on Election Day and observed the use of optical scan machines.  He observed the use of hand-cast optical scan ballots and tabulation problems that were caused by the manner in which the ballots were marked by hand.  We learned that hand-cast optical scan ballots have their own set of problems.

Instead of using a system of hand-cast optical scan ballots, we want to replace our WinVotes with machines that provide touch screen casting and printing of an optical scan ballots.  Most importantly, our voters have become accustomed to voting on touch screen machines.  The company called Democracy Live is on the cutting edge of such technology, and an affordable price.  However, the Democracy Live systems are not yet certified. 

Floyd County objects to having limited choices, or being in a position of buying equipment that will not be preferred in the long run.  There can never be confidence in a system acquired against our interests.  If there is a lack of buy-in, the system will be sour from the start.  

The Arlington Electoral Board objects to the very public manner in which this issue was announced. No prior warning was given to either local election offices or localities, and now we have been placed in an intenable position.

The Commissioner further states that the agency was unaware of vulnerabilities with the WINvote machines prior to late February. This is simply not true. Issues regarding the wireless function were known and discussed in depth by the State Board of Elections in 2007, in conjunction with localities and the system's vendor:

"...the system's design, programming, and security protocols directs the machines to only communicate with other WINvote machines.

I believe it is important to point out that upon programming these systems prior to an election, the system generates an 'encryption key' that only machines located in the same polling place, programmed with the same 'key,' could communicate with each other when operated by an election official with the appropriate access card and password.

I have sought legal advice to ensure that using the WINvote equipment is ineed in keeping with the law and have received those assurances."

- statement by Nancy Rodriques, Secretary, State Board of Elections, at SBE meeting on September 6, 2007

"WINvote equipment with wireless functionality may be used as prescribed and in compliance with security measures as contained in the United States Election Assistance Commission's Management Guide for Voting System Security."

- From a resolution adopted by the Virginia State Board of Elections, October 17, 2007

The agency has not provided evidence that they WINvote machines used in Virginia have been used in a manner inconsistent with approved security measures. The handling and timing of this issue is an insult to the dedicated local election officials who work hard ensure the integrity of Virginia's election.

Mr. McClees:

In regards to comments made by Virginia Commissioner of Elections, Edgardo Cortés, in his 1 April 2015 message titled, “Re: Interim Report on Voting Equipment Performance, Usage & Certification,” I would like to provide some informed input.  I provide this input based upon review of the materials provided by the Virginia Department of Elections, review of materials found on the Internet, and reliance upon my background in computer network system analysis, cyber vulnerability analysis, and technical analysis regarding cyber threats.

I will not address the “alignment” or “calibration” issues best described as operator error or manufacturing deficiencies in the Commonwealth of Virginia’s “2014 November Election Voting Equipment Voting Report.”  I will, instead, focus my comments on the most impactful aspect of cyber vulnerabilities that could affect election results.  My conclusions parallel those found in the 30 March 2015 message from Matthew Davis, Chief Information Officer, in his report titled, “AVS WinVote Voting Equipment Security Concerns.”

The fundamental exposure presented by the WinVote Direct Recording Electronic (DRE) voting equipment stems from the fact that computer technology evolves faster than human bureaucracy can mitigate its ill effects.  The speed of this technological evolution has been captured in a well-understood maxim called Moore’s Law.  The Wikipedia entry for Moore’s Law states, "… over the history of computing hardware, the number of transistors in a dense integrated circuit has doubled approximately every two years.”  This has resulted in a doubling of digital capabilities whether that is the case for beneficial medical devices or destructive cyber malware.

• Wikipedia link to Moore's Law

The Findings section of the Department of Elections report titled, “Interim Report on Voting Equipment Performance, Usage, & Certification” highlight that the most vulnerable aspect of the WinVote DRE system is its wireless communications capability.  Simply put, cyber security experts generally agree that there is no enduring security with any wireless system given the escalation of technological capabilities to intercept signals and that wireless systems provide the most critical aspect for any cyber attack: a venue for access.  Scenarios for this kind of attack include, but would not be limited to, attacks launched from a vehicle parked in the parking lot proximate to any polling station and attacks launched from handheld devices within the polling station.  The description within Paragraphs 3 and 4 on Page 2 of that report illustrates the capabilities of even inadvertent and spurious wireless signals from “smart phone” devices.

The report’s Findings are myopic, however, since they incorrectly attribute the WinVote DRE machines as the important vulnerability and not in the centralized vote-collecting machine that communicates with all “endpoint” WinVote DRE machines at the polling station.  A determined and disciplined cyber attacker will focus on the centralized and wirelessly-connected vote-collecting machine in order to achieve maximum impact for manipulating the outcome of the election or delegitimizing the entire election process.  Only a few incidents where the centralized WinVote database for the polling stations were deliberately deleted or corrupted would be required in order to create an immediate and wide-scale backlash from the voting public.

My recommendation is to not only immediately eliminate the use of WinVote DRE machines for any future elections but to also embargo any and all wireless technologies for use by any voting system.  The vulnerability that wireless technology presents is too great given the constant exposure that malevolent technological evolution will continue to present.

Very respectfully,

James Hull

King George, Virginia

There is nothing more fundamental to our democracy than the right to vote. And people must believe that the system they use to vote is accurate, fair and can not be tampered with. A voting machine that causes potential voters to question the integrity of the process is a machine that hurts people's belief in free and fair elections and, ultimately, in the functioning of our democracy. I know there is a cost associated with replacing these machines and that this may be a hardship for some localities. However, that hardship pales in comparison to the cost of people losing faith in our democracy.

I would also add that my understanding is that these machines use 16-bit encryption, a standard that no one responsible for protecting important, sensitive data would ever use. It is extremely vulnerable to hackers.

Please de-certify these machines so that they can be replaced immediately.

As a Virginia voter who is very concerned about the direction our country is taking, I am writing to you to request that you decertify the Win Voting equipment. Due to its wireless communication capability, it is vulnerable to hacking, and it is not verifiable without the ability to count or audit it. Several years ago, I worked at a voting location in my county and I was so overwhelmed by the number of people who take their voting responsibility so seriously. They stood in long lines in the rain just to vote: the Winvoting system makes a mockery of their patriotism. Please decertify Win Voting

The Election Board of Virginia has a fudiciary duty to ensure that all voting machines that are purchased on behalf of the citizens of the Commonwealth of Virginia may cast their ballots and a gurauntee for that ballot to be counted. Anything short of accomplishing that goal is an absolute failure and therefore, the act must not tolerated!

You must decertify the WinVote system decertified because it cannot be recounted or audited, and it cannot be made secure.

I am writing to express my strong displeasure with the Department of Elections proposal to decertify Winvote voting equipment.  The reports prepared by the Department of Elections and Pro V&V includes no factual evidence of vulnerabilities and is based on pure conjecture.

Decertification would set the precedent for similar ill-considered actions to happen anywhere, anytime, for any reason.  There is nothing keeping the Department of Elections from creating another subjective report a year from now to arbitrarily decertify another type of voting equipment - a fiscal burden that Virginia counties and cities cannot afford.

The use of subjective language in the interim report and Pro V&V report is an attempt to undermine the electorate’s faith in the electoral process and institute a costly and unnecessary unfunded mandate.  During the 2015 legislative session, the General Assembly Senate Finance Committee unanimously voted (14-0) against SB827 which would have banned the use of all types of DREs after July 1, 2016. Legislators are elected by Commonwealth voters and speak on behalf of the individuals who voted them into office.  The Department of Elections should not have the power to override the will of the people.

I implore the Virginia State Board of Elections  not to approve decertification of the WINVOTE system.  If a wireless vulnerability can be substantiated with actual evidence (which has yet to be provided to the elections community and the general public), a good compromise would be to simply prohibit localities from enabling the wireless capability on the device.

Respectfully submitted,

Nancy E. Tingen, City of Fairfax Deputy Registrar

When we used paper ballots that were marked with a pen or pencil there was no denying what the voter intended to vote for.  Paper punch (chads like the Florida fiasco) and electronic ballots like used in Virginia's last election has created way to many questionable ballots which resulted in time comsuming legal challenges. Progress and new technology may be good in the majority of circumstances but I don' see where technology has improved the voting process.  Voters who take time to vote expect their ballet to be counted and counted correctly with any court challenges...PAPER BALLOTS ony PLEASE.

The Pro V&V report and ELECT's investigation raise very serious questions about the security of WinVote machines. Quite simply, election security is of paramount concern and we urge the Board to consider decommissioning these machines. We can't wait for a catastrophic problem to occur. The WinVote machines are insecure and adversely affect the ability of every eligible Virginia voter to know his or her vote will be counted. 

While we understand decommissioning these machines may raise financial questions for the localities where they are in use, the threat to election security should override these concerns. The WinVote machines are over a decade old and in that time technology has advanced. In fact, the manufacturer has since gone out of business and no longer provides software updates. We understand Virginia is the only state still utilizing WinVote machines, we assume due to their outdated technology and the tendency of the machines to malfunction and break down as they age. 

We appreciate the Board taking the time to consider the repercussions of both continued use and decommissioning the WinVote machines and the opportunity for public comment. We strongly urge the Board to move to immediately decommission these machines to protect the integrity of our elections and ensure they remain free, fair, and accessible. 

I DO NOT BELEIEVE WE NEED NEW VOTING MACHIHINES AT THIS TIME.STAY WITH OLD NEW MACHINES WILL CAUSE MORE MISTAKES AND MORE INSTABILITY. I FIND THIS HIGHLY SUSPICIOUS YOU ARE THINKING OF THIS AT THIS TIME WHEN OBAMA IS TRYING TO STEAL VOTES FOR 2016;

THIS IS NOT TIME TO CHANGE AS IT TAKES A LEANING CURVE AND CAUSE MORE MISTAKES.  WE ARRE HAVING ENOUGH TROUBLE WITH OBAMA STEALING VOTES FOR  ILLEGALS IN 2016 DON'T ADD TO PROBLEM

I am in favor of de-certifying the WinVote voting system for several reasons.  It does not create a paper trail that can allow a recount or audit.  Also, I do not trust a voting system that includes a wireless capability.  We all know that even major companies with large security teams and state of the art security software are vulnerable to hacking by both domestic and foreign entities.  I therefore cannot trust a system that is available to entities who are not physically present at its keyboard (as would be a voter or voting official).  Please de-certify WinVote.  The integrity of our elections is more important than the convenience or ease of vote counting.

Anything electronic can be manipulated. Use paper without perforations, no more *hanging chad* incidents. All Voter Agencies  MUST keep updated voter registration lists -  removing deceased & voters no longer in the area.

I want the WinVote system decertified because it cannot be recounted or audited, and it cannot be made secure. 

Sincerely,

T Carothers

The release of Pro V & V’s report on the vulnerabilities of WinVote machines raises many serious questions about the security of the vote in Virginia. In light of the importance of elections and confidence in elections, the Fair Elections Legal Network applauds the decision of the Board of Elections to collect public comment and consider decertification of the machines in question.

Numerous laws have been passed in the General Assembly since 2011 in order to increase confidence and decrease the chance of fraud in our elections. The effort to cut down on supposed “voter fraud” included the removal of the certification of ID affidavit, the requirement of an ID to vote with over $1 million of state funds being spent to mail voter registration cards for use as ID, and immediately rendering those IDs invalid as the General Assembly passed a photo ID standard which was implemented in 2014 following robust debate.  The General Assembly has clearly taken the position that it is worth investing in the integrity of elections.

The SBE should consider immediately decertifying the WinVote machines in light of the commitment of the state to conducting fraud free elections and the proven vulnerability of these machines. The lack of proof that any elections have been affected by the machine vulnerabilities uncovered in the recent examinations should not change this assessment. Our elections are far too important to sit and wait for an election to be altered before taking action to remove any weak links.

We understand that many localities would be impacted if WinVote machines are decertified but believe that free and fair elections are far too important to sacrifice for the sake of inconvenience. The SBE should consider working with registrars to ensure enough machines are available for 2015 and work with the General Assembly to fund sufficient replacements for counties for 2016.

The SBE should also establish mandatory reporting standards to ensure that any possible system wide vulnerabilities, such as those discovered in the WinVote system, are uncovered and addressed quickly. Unfortunately, WinVote is no longer in business and cannot upgrade their system, but others may be able to in the future. The security of elections in Virginia should not be dependent on chance reviews.

Without a paper trail, how can we be sure the Win Vote system is reliable and accurate? Anyone with a lap top knows,that even with no outside malicious intent, computers will do some strange things! De-Certify the Win Vote system.

Dear Chairman Alcorn, Vice Chair Wheeler and Secretary McAllister:

I am writing on behalf of the Virginia Association of Counties (VACo). The proposed decertification of the WINVote machines will impact the election process in 25 of our Commonwealth’s 95 counties. VACo urges the Board of Elections to not rush to decertify these machines. Rather we ask you to work with the impacted localities, their General Registrars and their Electoral Boards to consider past experiences with these machines and their proposed technical fixes.

Banning the use of WINVote machines will be a significant unfunded mandate for many localities and the short timeline of such a potential decision will leave many with no budgeted funding to implement a change. It may also lead to a rushed procurement decision that is not in the long term interest of the electoral process of some localities.  Most importantly, banning these machines with very little time left before the June 9 primary may end up being a threat to the integrity of the electoral process in some localities.

VACo urges you to maintain certification of WinVote machines and to direct the Department of Elections to work with localities and election officials to implement and test proposed technical fixes to the current machines.

Sincerely,

Erik Johnston

VACo Director of Government Affairs

I urge you to decertify the WinVote electronic voting machines because 1) they are a security risk and 2) no one is available to repair them if they break.

All voting machines in Virginia should have a paper trail. The ability to do a recount is necessary if there is any doubt as to who the winner is.  The voters must have faith in our election system.  Our elected officials must slso know that the people support their leadership.

Get rid of the touch screen,  paperles voting machines! 

For years, old and malfunctioning equipment have contributed to a wide range of Election Day problems - from polling places opening late, which have resulted in long lines, to alleged vote switches due to miscalibration. In light of the widespread problems reported in the November 2014 elections, New Virginia Majority applauds the State Board of Elections and the Department of Elections for conducting a review and audit of the aging voting equipment, and we commend the State Board of Elections and the Department of Elections for your deliberate and transparent approach to evaluating the machines in question.

The report released last week from Pro V & V highlight troubling vulnerabilities in certain makes and models of DRE machines in use in Virginia, specifically the WinVote machines. Although the report that was released was not comprehensive, what is included in the report is sufficient to raise serious concerns about the security of the vote in Virginia.

While there is currently no evidence that the security of the past elections has been compromised by malicious actors, the reported vulnerabilities demonstrate how easy a target these machines can be in the future. As citizens, we deserve to have the utmost confidence in our elections. When voters cannot trust that their ballot is secure, trust in our democracy is undermined.

We urge the SBE to consider the immediate decertification of these machines. We understand that taking these machines out of commission can be difficult and expensive for localities, especially given this year’s elections. However, Virginia has elections every year; arguably, there is no convenient time to decertify equipment that is used by numerous localities across the Commonwealth. However, continuing to rely on outdated and insecure technology undermines our democracy and we must take proactive steps before a larger problem emerges.

We also hope that the SBE will conduct a more comprehensive review of all of the voting equipment used across the Commonwealth. This would require that all localities provide sufficient and timely reports to the SBE and the Department of Elections. Under §24.2-103, the State Board of Elections has the authority to require electoral boards and registrars to provide information requested by the State Board. We urge the SBE to move forward with establishing minimum reporting standards so that  so that the SBE and the agency can evaluate how elections are administered in Virginia in order to adequately address any vulnerabilities as well as unnecessary barriers to voting.

We look forward to working with you and localities to ensure a smooth transition away from the WinVote machines as soon as possible, and we commit to renewing our efforts to secure sufficient funding from the General Assembly in order to make sure that Virginia’s elections meet the highest of standards.

If the Commonwealth of Virginia is to take the mandate to protect voting integrity seriously, there is only one clear answer that reduces cyber security risk by orders of magnitude.

That solution is to follow the example of countries like Ireland, where the paper ballot is used in place of electronic voting machines.  A proper and neutral (not corporate) risk analysis will back this assertion up.  It is far more secure, more auditable, and engenders a startlingly larger increase in voter trust than any electronic apparatus.

The population of Ireland is, granted, around half that of Virginia; but if they can make it work, that belies any arguments that would claim a paper ballot for everyone would not work in Virginia.

I find it hard to believe that some jurisdictions have never had problems with the WinVote DRE machines.  But I find it even harder to understand why they seem to be anxious to play a game of chance with their voters by continuing to advocate their use long after other jurisdictions have reported problems – now verified by an independent report.  Although I hated to give up my home computer with Windows XP, the technology used by the WinVote machines, I became convinced of the need by several anguishing incidents.  I didn’t have thousands of voters depending on me to make the right decision.   I am lucky to live in Fairfax County which supported the purchase of new digital scan equipment that went into use at the 2014 elections.  This enabled the County to get a head start on its preparations for the many state and local elections this fall and the 2016 presidential election.   As a precinct election officer, I also appreciated having the new voting machines.  All Virginia voters have a right to believe that when they go to the polls to vote, the equipment will be working and their vote will be counted.   We should be thankful that the State Board of Elections and Department of Elections are taking their responsibilities in this regard seriously..

Paper ballots are the most secure way of verifying the vote. There have been far too many irregularities with the use of voting machines. I have personally experienced a change that occurred when I selected one candidate and another came up as selected and it took me 4 attempts before my chosen candidate entered correctly. Had I not noticed, my vote would have recorded incorrectly.

I have a degree in physics and  hold a General Radio Telephone License from the FCC.  There is no secure electronic or wireless form of vote recording.  Quantum mechanics prevents the renacting the vote once it is cast electronically.  I would respond to those in this list supporting WinVote stating there have been no irregularites in their districts.  First the vulnerability of electronic voting has been demonstrated unequivocally.  Second is exactly the point that they would never know if any irregularity did occur without paper records.

Virginia Verified Voting endorses the proposed decertification of the WinVote Direct Recording Electronic (DRE) voting system.  

Our reasons for supporting the decertification include:

(1) Every DRE that has been examined in the US has been found to have significant security flaws, so we are not surprised that the WinVote systems are highly vulnerable.  These vulnerabilities are the reasons that virtually all states stopped purchasing DREs some years ago, and nearly all states are moving towards purchasing optical scan systems which allow for auditing.   The WinVote was decertified in Pennsylvania several years ago due to security concerns.

(2) The WinVote is at higher risk to security attacks than any other DRE in the US, because it is the only DRE that includes WiFi technology, allowing it to be attacked without any physical access to the voting system.  The encryption used, WEP, can be bypassed within a few minutes using an ordinary laptop computer, allowing any attacker within several hundred feet of the polling place to see and potentially modify votes.

(3) There is no way to know whether the WinVote systems have been compromised in the past, nor would there be any way to know if they are compromised in the future.  The WinVote system has no monitors, logs, anti-virus, or other detection mechanisms.

(4) Aside from the issue of WiFi security, votes are stored by the WinVote in an obsolete version of the Microsoft Access database program.  Every WinVote machine sold has the same encryption key (“shoup”) which cannot be changed by the state or localities, and so while the data is nominally encrypted, there is in reality no protection against observation or manipulation of the votes.  An attacker who gains access to any WinVote machine (e.g., via a WiFi attack) can change all votes without any evidence.

(5) The WinVote DRE is based on the Microsoft Windows CE 3.0 operating system, which has not received any security updates since October 9, 2007. Hence, any security vulnerabilities discovered over the past eight years are unpatched on the WinVote.  By contrast, there have been hundreds of security fixes to the Windows operating system over that time period, many of which likely exist in Windows CE, but no fixes are available.  (See http://www.microsoft.com/windowsembedded/en-us/product-lifecycles.aspx)  

(6) The manufacturer of the WinVote, Advanced Voting Solutions, went out of business several years ago.  To the best of our knowledge, no company or individual is maintaining the software to fix any problems in the voting software, even aside from the Windows CE operating system.

(7) The WinVote system was certified against the 2002 Voting Systems Standards (VSS).  The replacement for that standard, the 2005 Voluntary Voting Systems Guidelines 1.0 (VSSG), and the newer VSSG 1.1 (adopted in 2015) both prohibit wireless communications.  Thus, the WinVote clearly does not meet current standards for voting systems security, even if it met the standards at the time it was purchased.

Turning off the WiFi in the WinVote systems will reduce the risk, but the security vulnerabilities are far beyond just WiFi, as the security analyses of every other DRE brand have demonstrated.

There is no doubt that voters appreciate the ease of use of the WinVote DREs.  However, familiarity and ease of use does not equal security.  

The State Board of Elections should decertify the WinVote machines immediately, and prohibit their use in any future elections.

Sincerely

Jeremy Epstein
Co-founder, Virginia Verified Voting
Member of the Advisory Board, Verified Voting Foundation, Inc.

Virginia Verified Voting endorses the proposed decertification of the WinVote Direct Recording Electronic (DRE) voting system.  

Our reasons for supporting the decertification include:

(1) Every DRE that has been examined in the US has been found to have significant security flaws, so we are not surprised that the WinVote systems are highly vulnerable.  These vulnerabilities are the reasons that virtually all states stopped purchasing DREs some years ago, and nearly all states are moving towards purchasing optical scan systems which allow for auditing.   The WinVote was decertified in Pennsylvania several years ago due to security concerns.

(2) The WinVote is at higher risk to security attacks than any other DRE in the US, because it is the only DRE that includes WiFi technology, allowing it to be attacked without any physical access to the voting system.  The encryption used, WEP, can be bypassed within a few minutes using an ordinary laptop computer, allowing any attacker within several hundred feet of the polling place to see and potentially modify votes.

(3) There is no way to know whether the WinVote systems have been compromised in the past, nor would there be any way to know if they are compromised in the future.  The WinVote system has no monitors, logs, anti-virus, or other detection mechanisms.

(4) Aside from the issue of WiFi security, votes are stored by the WinVote in an obsolete version of the Microsoft Access database program.  Every WinVote machine sold has the same encryption key (“shoup”) which cannot be changed by the state or localities, and so while the data is nominally encrypted, there is in reality no protection against observation or manipulation of the votes.  An attacker who gains access to any WinVote machine (e.g., via a WiFi attack) can change all votes without any evidence.

(5) The WinVote DRE is based on the Microsoft Windows CE 3.0 operating system, which has not received any security updates since October 9, 2007. Hence, any security vulnerabilities discovered over the past eight years are unpatched on the WinVote.  By contrast, there have been hundreds of security fixes to the Windows operating system over that time period, many of which likely exist in Windows CE, but no fixes are available.  (See http://www.microsoft.com/windowsembedded/en-us/product-lifecycles.aspx)  

(6) The manufacturer of the WinVote, Advanced Voting Solutions, went out of business several years ago.  To the best of our knowledge, no company or individual is maintaining the software to fix any problems in the voting software, even aside from the Windows CE operating system.

(7) The WinVote system was certified against the 2002 Voting Systems Standards (VSS).  The replacement for that standard, the 2005 Voluntary Voting Systems Guidelines 1.0 (VSSG), and the newer VSSG 1.1 (adopted in 2015) both prohibit wireless communications.  Thus, the WinVote clearly does not meet current standards for voting systems security, even if it met the standards at the time it was purchased.

Turning off the WiFi in the WinVote systems will reduce the risk, but the security vulnerabilities are far beyond just WiFi, as the security analyses of every other DRE brand have demonstrated.

There is no doubt that voters appreciate the ease of use of the WinVote DREs.  However, familiarity and ease of use does not equal security.  

The State Board of Elections should decertify the WinVote machines immediately, and prohibit their use in any future elections.

Sincerely

Jeremy Epstein
Co-founder, Virginia Verified Voting
Member of the Advisory Board, Verified Voting Foundation, Inc.