Below is a copy of my public comment submitted to the North Carolina State Board of Elections (SBE) on July 1, calling on them not to certify the ExpressVote ballot marking device.

The SBE is taking public comments on certifying ExpressVote and other systems from ES&S through July 5 at 1:00 PM. Click here to submit your public comment.

The North Carolina State Board of Elections should not approve the ExpressVote ballot marking device for general usage in North Carolina elections.

North Carolina has an unhappy history with touchscreen voting systems, as I noted as background in a report on the 2020 election: WHAT HAPPENED IN 2020? (page 52):

In 2002, two Election Systems & Software’s (ES&S) iVotronic system touchscreen voting machines lost 436 early voting ballots during the general election due to a software glitch. Election officials contacted those voters to redo their ballots on election day. In 2004, a UniLect touchscreen voting system irretrievably lost 4,530 ballots in Craven County. That same year, 800 to 900 constituents were not allowed to vote in a school board race when the touchscreen voting system failed to load those particular ballots. In 2018, voters in Guilford County reported that the touchscreen voting machines changed their votes, a problem the county elections director attributed to the age of the devices, which were purchased in 2006.

The General Assembly partially addressed that problem by requiring all election systems to produce paper ballots. However, ballot marking devices (BMDs) are still vulnerable to the issues that have plagued other touchscreen voting systems. In addition, BDMs may suffer from the same calibration problems as they age that led to other aging touchscreen systems flipping votes, as witnessed in North Carolina just five years ago.

David Levine, with the German Marshall Fund’s Alliance for Securing Democracy, noted three vulnerabilities BDMs suffer in an article published in the Fayetteville Observer on December 12, 2019:

First, barcode ballots are less secure than hand-marked paper ballots. A barcode can scan different votes from the text represented on the summary card (the portion voters can read). This creates an opportunity for discrepancies that voters cannot see. And since North Carolina does not currently audit this election process, there is no opportunity to review votes before they are certified. Additionally, since barcodes are essentially coded data inputs into a computer, computers could potentially be hacked to manipulate barcode scanners.

Second, barcode ballot systems are more expensive than systems with hand-marked paper ballots, as analyses from Georgia, Pennsylvania and other places have shown. BMDs are not a wise use of money, particularly when there are so many other things that need to be done to secure our elections — improving post-election audits and strengthening cybersecurity, to name a couple — with limited resources.

Third, using a barcode ballot system makes it harder to audit election results — an essential election security feature for confirming the outcomes of the election.

If there is a problem with the BMD’s software, intentional or not, and it isn’t detected, state and local election officials won’t know if there is a problem with the election outcome. This differs from paper ballot systems, in which voters mark paper ballots that are subsequently tabulated by scanning devices and the paper ballots themselves serve as a mechanism to ensure the outcome is correct, even if the voting system software has undetected issues.

The incompatibility of BMDs with voter verification and post-election audits has been raised repeatedly by researchers.

With hand-marked paper ballots, if a voter says that the mark on their ballot is not how they intended to vote, election officials can say with certainty that the voter mistakenly marked the ballot. However, BMDs create a black box between the voter’s intent and what is marked on the ballot. If a voter claims that what is printed on a ballot is not how she voted, officials cannot say with certainty if the voter made a mistake or if there is an error in the BMD.

Just as troubling is that voters often do not recognize when there are errors with BMDs. In their 2018 study “What Voters are Asked to Verify Affects Ballot Verification: A Quantitative Analysis of Voters’ Memories of Their Ballots,” Richard DeMillo, Robert Kadel, and Marilyn Marks found problems that question the reliability of both voter verification of and post-election audits of BMD ballots:

Voters either fail to recognize errors in ballots presented to them for verification or fail to recognize that the ballots presented for verification were not the ones they cast. These results are broadly consistent with other recent studies that cast doubt on the reliability and accuracy of memory recall and are evidence of voter memory errors that would make a verified ballot summary card impossible to rely upon as a reliable source record for a post-election audit.

A 2020 report, “Ballot-Marking Devices Cannot Ensure the Will of the Voters,” by DeMillo, Andrew Appel, and Philip Stark, was starker:

It is not easy to check whether BMD output accurately reflects how one voted in every contest. Research shows that most voters do not review paper ballots printed by BMDs, even when clearly instructed to check for errors. Furthermore, most voters who do review their ballots do not check carefully enough to notice errors that would change how their votes were counted. Finally, voters who detect BMD errors before casting their ballots, can correct only their own ballots, not systematic errors, bugs, or hacking. There is no action that a voter can take to demonstrate to election officials that a BMD altered their expressed votes, and thus no way voters can help deter, detect, contain, and correct computer hacking in elections. That is, not only is it inappropriate to rely on voters to check whether BMDs alter expressed votes, IT DOESN’T WORK.

Risk-limiting audits of a trustworthy paper trail can check whether errors in tabulating the votes as RECORDED altered election outcomes, but there is no way to check whether errors in how BMDs record EXPRESSED votes altered election outcomes. The outcomes of elections conducted on current BMDs therefore cannot be confirmed by audits. This paper identifies two properties of voting systems, contestability and defensibility, that are necessary conditions for any audit to confirm election outcomes. No commercially available EAC-certified BMD is contestable or defensible [emphasis in the original].

Due to their incompatibility with voter verification and post-election audits, BMDs are inconsistent with secure elections.

North Carolina has made progress in moving away from touchscreen voting systems (including BMDs), going from 22 counties using them in 2018 to just 11 in 2022. The State Board of Elections can continue that progress by only certifying the ExpressVote ballot marking device for limited use in compliance with the Americans with Disabilities Act. County boards of elections should phase out the use of their current stock of ExpressVote BMDs by the end of this decade.

(Cover photo is of an ExpressVote BMD (left) and tabulator in Jackson County, North Carolina, June 2022.)

UPDATE: The State Board of Elections voted to certify all of the ES&S systems, including the ExpressVote BMD.