Gahana County OH revisited

The following post is from Nov. 14. Programmers what do you think? I think we need to figure out how/what happened here it may be the only smoking gun in OH regagarding tabulation fraud:

On edit the original thread from Nov. 14:
http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=203x48519

Originally posted by DU memeber WhiteKnight


/*

About me:
I have a graduate degree in computer science, and more than 15 years of experience as a software engineer working with highly reliable systems.I have a knack for looking at the results of software failures and figuring out what's wrong with the code. For now, I prefer to remain anonymous and will go by the handle: WhiteKnight
(email: whiteknightfordemocracy@yahoo.com ).


About the bizzare vote counts in one Ohio Precinct:

After seeing the Associated Press story titled "Machine Error Gives Bush Extra Ohio Votes", I started thinking about the numbers reported in the story, whichare:

Votes for Bush: 4258
Votes for Kerry: 260
Total number of voters: 638

It also says that Bush "actually received 365 votes". That means there must have been 13 votes for other candidates (638-260-365 = 13).


I wondered how this result could have been produced. They called it a "failure", but I know a lot about how systems can fail, and this sounded fishy. Why were Kerry's vote totals recorded properly, but not Bush's? It's much more likely that a system failure would cause either no vote totals to be recorded at all, or that both totals would be corrupted.

I suppose it could have been a hardware failure that occurred right after Kerry's vote total had been written to storage, and just as Bush's was being written. But that's likely to be a very narrow time window. It's possible, but sounds like a very rare failure mode. It just seems odd that out of the whole universe of possible failures, we get a failure that records Kerry's votes correctly, and corrupts Bush's total.

Think of it this way: In basketball you know there are many ways a shot can fail to go in. It can go off the glass and miss, it can bounce off the front of the rim, rattle out, airball etc... etc... But there is one particular failed shot that's very rare: when the ball comes in at just the right trajectory with just the right speed, and it lodges between the rim and the backboard - just sticks there. I've seen it happen maybe a couple of times in years of watching the NBA.

So think of the odds of a failure that records Kerry's votes correctly, but corrupts Bush's as analogous to the ball jamming there between the rim and backboard. Pretty rare failure huh? Well, it gets even worse:

Why was the number off by only several thousand?

If the votes are added up using a 4 byte unsigned integer, then the possible values range from 0 to 4,294,967,296 (over 4 Billion). If a random bit error or hardware storage error occurred, then why didn't Bush get say 3,239,568 extra votes in this particular "failure"? Most true failures would result in some wild number that you would immediately recognize as garbage.

The analogy here is: not only did the basketball lodge between rim and glass, but the Spalding logo ended up perfectly horizontal, aligned front and center.

Given all of this, I decided to explore ways that vote counting software could end up with these particular results. Was someone adding a percentage to the Bush votes? Was there some multiplier involved?

After thinking about it for an hour or so, I decided to take a different tack: think like the person who is trying to rig the election. What would you do? You wouldn't really want to change the total number of voters. That might be too easy to detect given people being checked off on voter roles. Instead you would want to shift votes from one candidate to another. Maybe every 10th vote for kerry, you'd instead give to Bush.

OK, that's pretty easy to program, but it wouldn't expain the bizzare results in this one precinct in Ohio. But... what if the evil programmer made a mistake? Maybe one line of code had an error they didn't catch.

I decided to write a small vote counting program, and add in a function to steal every 10th vote. Once that was working I'd introduce a small error and see if the results came close the Ohio results reported by AP.

The program below is the result.

As you will see, there is one line of code that is supposed to add a stolen vote to Bush's total, and should be written as:

b = b + 1;

but (I theorize) it was mis-typed as:

b = b + k;

So instead of adding one stolen vote to Bush's total, it adds the running total of Kerry votes to Bush's total. Whoops!

The output from the program with the typo in place is:

starting election
Election results: b: 4258 k: 260 o: 13
(the actual votes: b: 336 k: 288 o: 14)

The output from the program with the typo corrected is:

starting election
Election results: b: 365 k: 260 o: 13
(the actual votes: b: 336 k: 288 o: 14)

So the intent was to shift 29 votes from other candidates to Bush, but the one-line programming mistake gives him an extra 3922 votes.

I'm not saying this proves that this is what happened, but it does indeed prove that a small, one-line programming error by an evildoer programmer could produce the results seen in this one Ohio precinct.

-WhiteKnight

p.s. Please circulate this as far and wide as possible. Thanks!

*/
#include <stdio.h>
#include <string.h>

// Vote totals for b=Bush k=Kery o=Other
int b=0, k=0, o=0;
// The set of "real" books:
int breal=0, kreal=0, oreal=0;

//
// Here's the hypothetical "patch" that the evildoer programmer
// might have written:
//
void robOhio(int creal, int* c) {
// Look for every 10th vote from this candidate:
if ((creal % 10)==0) {
// OK, here's the bug. Should have been
// b = b + 1;
// Give the vote to b
b = b + k;
// Take it away from other candidate:
*c = *c - 1;
}
}


int main() {
char votes<1000>;
//
// Here are the votes in a hypothetical order that I made up.
// So in this example, the first two votes went to Kerry, the
// next two to Bush, then one for Kery, one for Bush, one for
// Other, and so on.
//
// The order of the votes does affect the final numbers but,
// even if you change the order, the rough order of magnetude
// of the bogus results stays about the same.
//
//0 1 2 3 4 5
//12345678901234567890123456789012345678901234567890
strcpy(votes,"KKBBKBOKBBKKBBKBBKBBKKBBKBBKBBKKBBKBBKBBKKBBKBBKBB"); // 50
strcat(votes,"KKBBKBKKOBKKBBKBBKBBKKBBKBBKOBKKBKKBKKBBKKBBKBBKBB"); // 100
strcat(votes,"KKBBKBBKBKKKBBKBBKBBKKBOKBBKBBKKBKKBBKBBKKBBKBBKBB"); // 150
strcat(votes,"KKBKKBBKKBKKBKKBBKBBKKBBKBBKBOKKBKKKBKBBKKBBKBBKBB"); // 200
strcat(votes,"KKBKBBBKBBKKBKKBBKBBKKKBKBBKBOKKKBKBBKBBKKBBKBBKBB"); // 250
strcat(votes,"KKBBKBBKBBKKBKKBBKBBKKBBKBOKBBKKBKKBBKBBKKBBKBBKBB"); // 300
strcat(votes,"KKKBKBBKBBKKKBKBKKBBKKBKKOKKBKKKBBKBBKBBKKBBKBBKBB"); // 350
strcat(votes,"KKBKKBBKBBKKBBKKBKBOKKBKKBBKBBKKBBKBBKBBKKBBKBBKBB"); // 400
strcat(votes,"KKBKKBBKBBKKBBKBBKBBKBBKKBBKBBKKBBKBBKBBKKBBKBBKBB"); // 450
strcat(votes,"BKKBKBBKBBKKBBKBBKBBKKBKKBBKBBKKBKKBBKBBKKBBKBBKBB"); // 500
strcat(votes,"KKKBKBBKBBKKBBKBBKBBKKBBKBBKBBKKBKKBBKBBKKBBKBBKBB"); // 550
strcat(votes,"KKBBKBBKBBKKBBKBBKBBKKKKKBBKBKKKBOKBBKBBKKBBKBBKBB"); // 600
strcat(votes,"KKBBKBBKBBKKBBKBBKOBKOBKKBOKBOKKBBKBBK"); // 638

printf("starting election\n");

// Start counting votes:
for (int i=0; i<strlen(votes); i++) {
char v = votes;
if (v=='B') {
b = b + 1;
breal = breal + 1;
} else if (v=='K') {
k = k + 1;
kreal = kreal + 1;
// This is not a vote for b, so steal some votes:
robOhio(kreal, &k);
} else if (v=='O') {
o = o + 1;
oreal = oreal + 1;
// This is not a vote for b, so steal some votes:
robOhio(oreal, &o);
}
}
printf("Election results: b: %d k: %d o: %d\n",b,k,o);
printf("(the actual votes: b: %d k: %d o: %d)\n",breal,kreal,oreal);
}

Please make it simple for simple me. Are you saying the fraud was internal
to the machine's computer. i.e. programed to switch votes?


:kick:

in a strange "red box" precinct. Can't remember the exact # 9661 or something but 61 voters and 384 votes went to *.... bet there's a lot of it. Strange that all those "extras" went to *. Hmmmm

and another DUer suggested I bring it back up since it was buried forgotten in the archives.

If it was Franklin County I believe this means Danaher Controls is the voting system vendor.

this is the infamous 4,000 extra votes for Bush that has never been explained.

I'm wondering what precinct this was.
From the official abstract of the Franklin County election results Gahana only has 4 precincts and each has 7 or 8 wards.

1B is the only one that matches these final results except for the third party votes.
Bush 365
Kerry 260
Badnarick only had 2 votes, not 13.

Here is the abstract, which is on my site. You can also find it on the Franklin County Site. Scroll down to Gahana 1

http://my.core.com/3E/28/dlrslr/Official_Abstract_of_Votes_General_04.pdf

The votes in question reside on a hardware cartridge and are counted by hardware reader specifically designed to do so. If your theory were correct we would see the same problem all over the county. A second reader read the cartridge just fine and the totals it gave matched those stored in the in-machine memory.

It seems to me that the most likely explanation is hardware failure. That one cartridge or the specific reader had some kind of defect.

I find the theory that one cartridge or reader was specially programmed (this is hardware remember not a PC) to benefit Bush in machines that we have been using in Franklin county for over 10 years to be ... well highly unlikely is probably the kindest way to say it.

Isn't there a type of memory that resides on hardware that could have had the cheater code. I cannot remember what it is called, but I do remember my boss mentioned it when we were talking about vote fraud.

These Danaher 1242 voting machines have both a processor and firmware, so to call them "hardware" is, in the kindest way to say it, disingenuous.

There is very little detail online about how these machines work, or the code therein. In fact, these details are deliberately kept secret.

The firmware is labelled "5T" or "6T" as of 11/01/01, or "4T10," "5T2" or "6T2" as of 12/05/02. see: http://www.eff.org/Activism/E-voting/gvs_electronic_1242_v0.3.pdf

This whopper was for the whole precinct. Unless the whole precinct used just one machine, it points to a tabulation "error". Also, the Unofficial Results show this "error". I've been curious as to how they were able to come up with the correct number. Did they visually inspect the machines, or the memory cartridges?

There's only one other precinct in the county that showed a different tally from the unofficial and official results.

COLUMBUS 58-F

Unofficial: Bush 398, Kerry 383, Others 16
Offical: Bush 498, Kerry 493, Others 19

Again, how was this corrected?

were recorded. The bogus figure has never been explained.

It is hard to figure out what happened with so little information.

I am not going to pretend i even understand most of what you said. But to my mind it seems if there is a rhythm there should be a pattern to the votes. It is looking unlikely any trace of code would be available. So if we are going to find something hard on this we may have to prove through the vote. Does this make sense? This is so not my area.

reproduced the extra 4000 votes. Because the extra 4000 votes were more than the total voters (not good if you want the fraud to go undetected), it is surmised the fraud program had a mistake. This was an individual card reader that gave Bush the extra votes, another one read the tallys correctly.

Here are some problems with this whole approach.

This one instance could be viewed as a fluke, especially if it is not repeatable. I am not saying that it was in fact a mere random error, but that people will think that it was unless there is something more to the story.

Even if we can show that an algorithm could result in the observed numbers, that doesn't mean it was. The algorithm that WhiteKnight wrote is dependent on the order of the votes, as he says, and since we don't know the order, we have to make up an order that ends up working. That makes it less convincing.

Can we show that this occured anywhere else? Is there a common algorithm that worked without notice in other instances but only here did it stand out because it was so obviously flawed? Why would it be only used on only one machine? It would not be enough to make a difference if only one machine were used, so it is not enough to convince anyone of fraud if strange results are only found on one machine. Decompiled code that shows the vote changing would, of course, be convincing evidence.

This is actually very amazing since it gives the exact result. I do not program in C so can you please explain why the real votes didn't match with the actual votes but the fraud votes matched perfectly in your simulation?

Also, your explaination of a random computer error is right on in saying it is nearly impossible. If a total is corrupt you would get a wild number like the extra 25 million one machine recorded.

I am a JavaScript programmer (as well as many other things) and I plan to translate this C program in to JavaScript and build a demonstration of how this works on a web page. This will make it more apparent to more people what might have happened.

Total votes actually cast = 638

If you multiply that times 2/3, and then make a decimal error of one place, you get almost precisely the errant Bush total.

638 x .6674 .. maybe was the original instructions - tell the aging Danaher machines to give Bush 2/3 of the vote.

But, if you messed up the decimal, you got 10x too many.

638 x 6.674 .. that would give you 4258.

4258 is what the original tally gave Bush.

Welcome to DU!! :toast:

The vendor is Danaher Controls. Specifically the memory card readers.
Literally how could this be accomplished and who would have access?

Anyone that had access to the source code. After this the code could easily be deleted at a certain time so it couldn't be found after the elections. However, I'm not sure if the machines had internal clocks (they should have).

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=201x1406

From the thread above:

You can see this machine's spec sheets here:
http://vevo.verifiedvoting.org/article.php?id=5183

A little research shows that this machine is just a rebadged Shouptronic 1242.
http://www.electioncenter.org/about/nased3.htm

When cast, voting records are recorded internally to
eight memory locations: three banks of battery-powered RAM,2 three banks of
EEPROM3 memory, one bank of EPROM4 memory and a removable memory cartridge,
which contains both EPROM and EEPROM memory. When polls are closed, poll
workers remove the memory cartridge that contains the vote records from each machine.
These cartridges are then either physically transported to a tabulation facility or their
contents transmitted over modem using a cartridge reading device.

From:

http://www.eff.org/Activism/E-voting/gvs_electronic_1242_v0.3.pdf

B = B + f*K where f was suppose to be some fraction between 0 and 1 (but much less than 1), perhaps determined in some way by an algorithm (in FORTRAN a subroutine), but again there swas a bug which caused f to default to 1 and never get reset. Anyway that's a clever find you made.
This really needs to be followed up on!

2000 Vote:

Total Votes 451
Bush 248
Gore 187
Other 16

2004 Vote:

Total Votes 627

Bush 4258 (Unofficial), 365 (Official)
Kerry 260 (Unofficial and Official)
Other 89 (Unofficial), 2 (Official)

Gore 2000/Total 2000 =
187/451 = 0.414634146

Kerry 2004/Total 2004 =
260/627 = 0.414673046

Bush 2000/Bush 2004 (Official)
248/365 = 0.679452055

Bush 2004 (Unofficial)/Total 2004
4258/627 = 6.791068581

and Bush's 2000 percentage and his unofficial percentage are the same if you move a decimal.

Gahana needs to be analyzed by some of the brightest IMHO.

We need to get ahold of comparable hardware. These Shouptronics are obsolete, someone has got to have one to lend or sell.

You may have found a pattern that we should look for in other precincts.

Kerry got almost exactly the same percentage of total votes in 2004 as Gore did in 2000, both 41.46%. That seems like too much of a coincidence, and it may be cause for suspicion all by itself, as if they forced the same percentage for Kerry as Gore got in 2000.

Here is the formula that might have been used to keep the same percentage in 2004 as in 2000:

Kerry = total_2004 * Gore_2000_percentage
Bush = total_2004 * Bush_2000_percentage

But if Bush were to get the same percentage of total votes in 2004 as in 2000, that would be 54.99% (Bush 2000 / Total 2000 == 248/251 == .54988) and so in 2004 he should have been given 54.99% of 627 == 344.78 or 345. He officially got 20 more votes than that: 345 + 20 == 365.

It might be too suspicious if the total number of votes were changed by simply adding more to Bush without taking away from Kerry or elsewhere. If the total were unchanged, and Kerry got the same percentage, then the extra 20 had to come out of the "other" category. But all this would have happened after the "official correction" of the bogus 4258 number, and so maybe the 20 added votes is completely independent of whatever caused the 4258 number.

On the other hand, maybe the 365 is the correct number, since they were probably thinking that there would be more scrutiny of this precinct, so better to play it safe. They must have hand counted it, right?

The most bizarre coincidence is next: The calculation you showed for Bush suggests that the ratio of his 2000 votes to 2004 votes (248 / 365 == .679) is the same as 10 times the ratio of his unofficial 2004 votes (== 4258) to the 2004 total (== 627). But this doesn't make sense. Why would a hacker ever come up with that formula? I can see the 10 times factor happening due to a slip of the decimal point when entering a percentage, but the rest is just screwy.

Can the mistaken formulas be rearranged into something a little more rational? Here is the Bush formula that results in him getting 4258. Actually, it works out to 4260.

Bush = total_2004 * (10 * Bush_2000 / Bush_2004)
4260.16 = 627 * (10 * 248 / 365)

I give up for now. Maybe this will give someone else an idea.

In this precinct, Kerry got exactly the same percentage of the total vote in 2004 as Gore did in 2000, down to the hundredth of a percent: both were 41.46%. That is very improbable, and it suggests it was forced. Could someone do a comparison in other precincts to see if anything turns up?