1. The document describes the Humboldt County Election Transparency Project which uses open source software to scan ballots, publish digital images, and conduct independent vote counts. 2. Ballots are scanned and assigned unique identifiers while maintaining a verifiable chain of custody. Digital images are digitally signed for validation. 3. A ballot counting program called Ballot Browser is used to define contests, layouts, and count ballots in a transparent manner by displaying the steps taken to reach the reported results.

1. Humboldt County
Election Transparency Project
and Ballot Browser
Mitch Trachtenberg
April 3, 2009
Humboldt County Election Transparency Project
and TEVSystems.com

2. Overview
1. use all open source software
2. scan all ballots to digital images
3. quot;signquot; the collected images
4. publish the signed collections
5. do an independent count, using the images

3. Maintain chain of custody
1. minimum two persons, staff or deputized
2. forms for opening/closing each container
1. who removed container from secure storage, at what
date/time
2. who opened container, at what date/time
3. how many ballots scanned, who scanned, starting and
ending scan numbers
4. who closed container at what date/time
3. ballot transmittal and return form
4. project scanning logs

4. Scanner requirements
1. number ballots, in ink, on entry into scanner
2. scan both sides of a ballot at once
3. detect double feeds
4. Linux-compatible (SANE protocol)
5. smooth feeding of ballot weight paper

5. Scanning speed and costs
1. ETP used Fujitsu FI-5900C, capable of 5K/hour
2. Humboldt volunteers: 65 hours for 130,000 sides (2K
sides/hour), scanning SIMPLEX
3. Potential: up to 4K ballots/scanner-hour
4. Scanner cost approx $25-30K (multipurpose)
5. as-a-service costs should be substantially less than 20
cents per ballot, scanned and counted to 0.01% accuracy

6. Digital signatures
(from American Bar Association)
quot;...digital signatures have undergone thorough
technological peer review for over a decade.
Digital signatures have been accepted in several
national and international standards ... and by
many corporations, banks, and government
agencies.quot;

7. Digital signatures, cont'd
quot;The likelihood of malfunction or a security
problem in a digital signature cryptosystem ... is
far less than the risk of undetected forgery or
alteration on paper or of using other less secure
electronic signature techniques.quot;

8. Gnu Privacy Guard (gpg)
Image collections are validated with GPG, a free and open
source encryption program.
Linux provides quot;Seahorsequot; graphical interface:
right click signature file icon, select quot;Validate signaturequot;

9. Ballot Browser (counting program)
1. Open source and fully available to all
2. Not quot;orphan softwarequot; -- commercial support and training
are available
3. Operable on wide variety of platforms (Linux, but also
Windows and Mac OS X)
4. Understandable code for programmers
5. Understandable output for all observers
6. PHILOSOPHY: NOT A quot;BLACK BOXquot;. Don't just show the
results; show how the results were obtained, step by step.

10. Ballot Browser usage
1. Get one sample of each ballot type in election
2. Define all contests and choices in election
3. Define each ballot layout (5 minutes per card type)
4. Count all scanned ballots
5. Convert quot;dash patternsquot; to precincts
6. Print summary
7. Export details to spreadsheet and/or database
8. Decide on borderline cases needing human intervention

11. BB Contest definition

12. BB Layout definition
Choose template, click in list, click on ballot. Repeat.

13. BB Counting
1. Ballots being counted are displayed
2. Votes can be overlaid on ballot images
3. Count can be slowed down for observers
4. Count can be paused
5. Last three ballots can be redisplayed with counts
6. Rate: 7.5 K ballots/machine-hour on Mac Mini (five
machines can count 900,000 ballot sides in 24 hours)
7. Results from multiple machines can be easily merged.

15. Counting results
votes.txt: summary counts by precinct and contest,
votes.csv: suitable for spreadsheet import
Scan, precinct code, contest, choice, quot;Debugquot;, x, y, 0=dark to 255=light
quot;BALLOTquot; is a pseudo-contest, quot;CASTquot; a pseudo-choice
/home/mitch/00/00/000001.jpg,80040300,BALLOT,CAST, Debug, 0, 0, 0
/home/mitch/00/00/000001.jpg,80040300,Prop1,Prop1/P1Yes, Debug, 477, 1576, 69
/home/mitch/00/00/000001.jpg,80040300,Prop2,Prop2/P2Yes, Debug, 477, 1950, 81
nonvotes.csv:
/home/mitch/00/00/000001.jpg,80040300,Prop1,Prop1/P1No, Debug, 477, 1613, 243
/home/mitch/00/00/000001.jpg,80040300,Prop2,Prop2/P2No, Debug, 477, 1987, 240
/home/mitch/00/00/000001.jpg,80040300,Prop3,Prop3/P3No, Debug, 895, 864, 247
(nonvotes.csv includes quot;just missed being a votequot;)
(overvotes have quot;:OVERVOTEquot; appended to choice)

16. Write-ins
1. BB captures the write-in area whenever the associated oval
is filled
2. Write-in images are named after the ballot number and
race (Pres_006773.jpg_0.jpg)
3. Write-ins are grouped for ease of validation

18. Precinct assignment

19. Import into sqlite3
1. Define votes table (create table votes...)
2. Set mode to csv (.mode csv)
3. Import csv file (.import votes.csv)
4. Perform SQL queries (select...)
Time from CSV availability: less than 2 minutes.
How many votes for each Pres. candidate?
select count(*), choice from votes where contest = quot;Presquot; group
by choice;

20. mitch@mitch-desktop:~/bb50$ sqlite3 votes.db
SQLite version 3.5.9
Enter quot;.helpquot; for instructions
sqlite> .mode csv
sqlite> create table votes (filename text, dashcode text, contest text, choice text, debug text, x int, y int,
intensity int);
sqlite> .import votes.csv votes
sqlite> select count(*), choice from votes where contest='Pres' group by choice;
320,Pres/Barr
3,Pres/Barr:OVERVOTED
204,Pres/Keyes
1,Pres/Keyes:OVERVOTED
1,Pres/Keyes:OVERVOTED:OVERVOTED:OVERVOTED
2,Pres/Keyes:OVERVOTED:OVERVOTED:OVERVOTED:OVERVOTED
21707,Pres/McCain
2,Pres/McCain:OVERVOTED
1,Pres/McCain:OVERVOTED:OVERVOTED:OVERVOTED:OVERVOTED
644,Pres/McKinney
3,Pres/McKinney:OVERVOTED:OVERVOTED:OVERVOTED:OVERVOTED
923,Pres/Nader
16,Pres/Nader:OVERVOTED
1,Pres/Nader:OVERVOTED:OVERVOTED
2,Pres/Nader:OVERVOTED:OVERVOTED:OVERVOTED
39661,Pres/Obama
5,Pres/Obama:OVERVOTED
2,Pres/Obama:OVERVOTED:OVERVOTED
432,Pres/PresWrite-in
18,Pres/PresWrite-in:OVERVOTED

21. sqlite> select intensity, count(*) from votes
where (intensity + 0) > 210 group by intensity;
211|95
212|71
213|81
214|70
215|77
sqlite> select filename, contest, choice from votes
where (intensity + 0) = 215 limit 5;
/home/mitch/00/02/000216.jpg|2Rio|2Rio/Leonard
/home/mitch/00/06/000696.jpg|Prop1|Prop1/P1No
/home/mitch/00/09/000967.jpg|Prop3|Prop3/P3No
/home/mitch/00/15/001507.jpg|Prop1|Prop1/P1Yes
/home/mitch/00/15/001507.jpg|Prop3|Prop3/P3No

23. sqlite> select intensity, count(*) from nonvotes group by intensity;
216|56 236|113
Less than 0.1% of all nonvotes
217|58 237|201
have intensity from 216 to 235;
218|94 238|943
219|45 239|4287 these nonvotes may be
220|50 240|16062
manually inspected.
221|46 241|46594
222|45 242|102685
223|31 243|180524
Less than 0.2% of all votes have
224|38 244|258391
intensity from 200 to 215
225|30 245|329804
226|25 246|374186
227|39 247|339073
228|36 248|179779
229|42 249|44979
230|52 250|5119
231|51 251|640
232|57 252|188
233|58 253|154
234|76 254|198
235|81 255|441

24. Vote adjudication
1. All parties agree before election on desired vote intensity
threshold
2. Vote intensity threshold is applied to all ballots
3. Human observers need only intervene in exceptional cases

25. Overvote adjudication
1. All overvotes are flagged
2. Vote intensities of overvotes can be used with objective
rules to distinguish false from true overvotes

26. Moving forward
We would like to see all ballots scanned, nationwide, and their
images made available as a matter of course.
We would like to see independent vote counting become part of
standard elections office procedures.

27. Thank you!
Thank you!
Contact information:
Mitch Trachtenberg
PO Box 1352
Trinidad, CA 95570
mitch@TEVSystems.com
www.TEVSystems.com
(707) 496-0071