By Tim Craig
Washington Post Staff Writer
Saturday, June 6, 2009
Sequoia Voting Systems agreed yesterday to turn over sensitive information to the D.C. Council about how the District's voting machines work and tabulate results, setting the stage for one of the most comprehensive probes on the reliability of electronic voting equipment.
The agreement is a response to the election night chaos in the September primaries, when Sequoia machines tabulated more ballots than there were voters, resulting in thousands of phantom votes.
Electoral change advocates said the agreement, finalized yesterday in D.C. Superior Court after the city threatened a lawsuit, is one of the first times a manufacturer of electronic voting machines has been forced to endure a public vetting of how its equipment tabulates returns.
"It is certainly going to serve as a precedent not just for further investigations in the District of Columbia, but around the country," said John Bonifaz, legal director for Voter Action, a national voting rights organization.
According to a copy of the agreement, the District will have access to technical information on the internal workings of the machines, known as the source code.
The council, which will also get documents about how the machines were created and maintained, plans to turn the information over to a team of computer and legal experts to review.
"This is the first time, ever, that outside experts will be able to review the documents and everything that went into creating the source code," said council member Mary M. Cheh (D-Ward 3), who is heading the council investigation.
Michelle M. Shafer, vice president of communications and external affairs for Sequoia, said the company is "cooperating with the city council to resolve this matter without incurring further legal costs."
"We would like to move past this and resolve this once and for all and do what we can to make sure voters in D.C. feel confident about their voting system," Shafer said.
Bonifaz said he's hopeful that the investigation will provide clues to whether electronic voting machines are reliable and what, if any, safeguards need to be implemented to prevent mishaps.
In addition to the District, 17 states use Sequoia, one of three major providers of electronic voting machines, Cheh said.
Sequoia has turned over its source code to outside experts a few times before, but Cheh said the District will also have access to information that no other government or legal team has ever had a chance to review, including the blueprints for the company's machines.
Software experts are hopeful that the Sequoia data will unlock the mystery of the phantom votes, which initially produced inaccurate results in several contests, including two high-profile council races.
"Looking at the information we expect to get from Sequoia is the only way we will ever figure it out, if it is going to be figured out," said Jeremy Epstein, a senior computer scientist at Arlington County-based SRI International, who is expected to be on the team that will review the data.
Bonifaz said the council's probe could enhance calls for a return to paper ballots nationwide or, at the very least, a paper trail.
In 2007, Sequoia handed over data to the secretary of state's office in California as part of a review of the systems used there. As a result of that probe, Secretary of State Debra Bowen decertified Sequoia, as well as several other election systems, after investigators determined that the machines could be hacked.
Last year, a New Jersey judge ordered Sequoia to turn over limited amounts of information related to elections in that state to a Princeton University computer scientist, Andrew W. Appel. He concluded that a computer expert could hack into Sequoia machines within seven minutes "using simple tools," according to the Newark Star-Ledger.
Shafer, who noted that California municipalities are still using Sequoia voting machines, said it's not fair to compare the District investigation to the probes in California and New Jersey.
"These are all different matters and all different equipment," she said.
Sequoia has been fighting for years to keep the inner workings of its machines from the public, saying they are trade secrets. The company initially refused to comply with a council subpoena in the fall. When the council persisted, the company asked for a $20 million bond guaranteeing that the information would remain confidential, Cheh said.
She said she refused, and the District was scheduled to go to court last week to try to force the company to comply. But the company decided to reach an agreement instead.
As part of the deal, the city and its computer forensics team agreed to keep the company's "trade secrets" confidential. But Cheh said the council will be able to make public a report about potential vulnerabilities.
"They fought us tooth and nail till now, so I am pretty pleased we got this going," Cheh said.