Auditor was completely dumbfounded, and used the "F" word.

[garybeck]

In my "other" life I work at a large corporation. In an ironic twist of events, the business process I work on was selected for a random Audit. There's Karma for you I guess.

After demonstrating a few things, providing documents and records, and answering some questions to the auditor, I mentioned that it was funny this is happening now, as I've been working with election rights people to promote audits of the election system.

I described to her that our system here in Vermont uses paper ballots, but they're all scanned by proprietary code to count the votes, and there are no audits in place to make sure things are working right.

Her response?

She was literally speechless. She couldn't believe that a system could be set up like that and there wouldn't be regular audits in place, as part of the design, from the very beginning. I told her, you think that's bad, then we have the touchscreen voting machines that can't be audited even if we wanted to. She, an auditor by profession, who understands why there are audits and how they are done, was completely dumbfounded.

I started to agree how they should have audits, in case the machines aren't working right, and she jumped right in and said the "F" word. "Fraud" she says, "you'd need audits on those systems to prevent Fraud." It wasn't 30 seconds into the conversation until she brought it up, all on her own. It really is a no-brainer.

So here I am spending several hours of time, at the expense of my employer, to provide information for an audit, which would have no bearing on the life of any person should the audit find some kind of problem. The auditor is one of several full time employees who do that sort of thing all year round. And the audit is *internal* meaning no one outside the company is requiring us to do this. It's being done just because the company wants to make sure things are working as they should.

And at the same time, our election system which affects the lives of virtually everyone on this planet is going unaudited and in many cases unauditable.

What does it mean, that a company should care more about their internal processes than election officials care about the integrity of the elections they administer?


She was completely dumbfounded, and even though I've been doing this for over 2 years now, I'm still dumbfounded.

[Peace Patriot]

1. Me, too! n/t

[neoblues]

2. Dumbfounded? First time this thought occurred to her?

Wonder where she's been (mentally; politically)? Same place as most of the electorate I suppose.

Still, it's true, not much in the way of ISO9000 (or whatever) process requirements are in place, especially on state/county/local governments, though if there should be such requirements anywhere, it's our government.

[garybeck]

3. yes she was completely unaware, like most people.... n't

[eridani]

16. So, you stuffed her hands full of literature, I presume?

And the SolarBus CD, and a list of websites? Does she belong to any auditors' professional associations who might want to take this on?

[Febble]

4. Exactly

Nice story.

[emlev]

5. Good story--makes me wonder

if there are professional associations of auditors whose expertise might be useful to the election integrity movement.

[IndyOp]

7. Interesting thought! (n/t)

:hi:

[garybeck]

8. YES ABSOLUTELY

I have learned A LOT after being audited. There are terms that apply to any audit.

"Control Points"
The entire system is evaluated from start to finish. Any point in the system where a person can get access to data is called a control point. I had to demonstrate that only people who need access can get in. I had to show the process for giving access to those who need it. I had to show that every quarter I review the lists of people who have access and remove people who no longer need it.

"Separation of Duties"
My system is used to publish documents. I had to show there was separation of duties, so it't not good enough to just keep people out who don't need to be in there. I had to show that people can only perform the roles they need to. For instance, a person who wants to publish a document can input it into the system, but a different person has to approve it before it goes out the door. So basically a person can't approve their own documents.

Think about how these two basic concepts could easily be applied to election systems. A real audit would not just count the paper ballots and compare them to the machine counts. They would audit the whole system, evaluating all the control points and making sure there is separation of duties for every function. I think it's pretty easy to see how it applies.

[JudyM]

14. There's the Institute of Internal Auditors - they're a pretty competent bunch.

http://www.theiia.org/index.cfm?bhcp=1

[DBoon]

23. maybe ISACA...

http://www.isaca.org/

[IndyOp]

6. "I think we will look back on this and wonder why we ever voted this way"

...so said a member of my City Council after I gave a presentation about DRE voting and why we must have paper ballots so that we can audit the election results.

I was by how "bold" and clear his statement was - "I think we will look back on this and wonder why we ever voted this way."

:eyes:

[truedelphi]

9. Shame! Shame! I mean, don't you guys trust our election

Officials!<<sarcasm intended, REPEAT sarcasm intended

I am totally willing to let the election systems continue to be un-audited.

As LONG AS all election officials agree to have their money in a bank where no receipt is ever given, AND they can never ever check to see that any given deposit or check went in (on second thought - I'd let them check but a mandatory $ 13,000 payment would be required just as Frank Egger of Fairfax CA was asked for when he wanted a recount of his mayoral defeat)

And they should be told upfront that various tech support people will have their pin number for their debit and credit cards.

When the Registrar of Voter Officials all agree to the above proposals with their personal banking, then I am willing to go on the record and say the system of elections can stay as it is.

[thingfisher]

10. It is the institutionalization of fraud.

Soon our whole society will be fraudulent in every aspect. But since it is so ubiquitous it will seem normal. We will have all the traditional mechanisms of a free republic still in place but it will all be a sham, a fraud having all the apperances of freedom and democracy without the substance. Actually, it is pretty much the way things are today.

[hvn_nbr_2]

11. You better believe Diebold's ATMs are auditable and are audited. nt

[garybeck]

12. I guess money matters but votes don't. n/t

[eridani]

17. And so are slot machines ferchrissakes! n/t

[JudyM]

13. Congress passed Sarbanes-Oxley requiring audits of public co's. The requirements are intense, yet

the simplest process audits can't be performed on our voting equipment. It's positively ludicrous that it would even be an ISSUE for a congress that had so much discussion about the importance of auditing in passing Sarb-Ox.

:eyes: :mad:

[IWantAChange]

15. Please note the hue and cry for reform Madame Speaker - it is

incumbent upon the Democratic majority to enact legislation guaranteeing HONEST elections or the Repugs - after the blood they are going to shed in the upcoming oversight and investigative hearings - are going to do everything in their power to get back control.

[Hissyspit]

18. .

[mhatrw]

19. I'm dumbfounded as well.

Were we all supposed to just not notice or something?

[krispos42]

20. K&R

[autorank]

21. I love auditors...they're everyone's friend unless...

...you've to something to hide. I can't share my remarkable experience with a great team of corporate auditors but it was something I'll never forget. The dedication of these folks is really amazing and the intelligence and hard work are also there. When they descend on a problem area, they're particularly capable and thorough.

They have a process that makes sense and that exposes error and corruption. It also aids in efficiency.

I'd not thought about my 'fun with corporate auditors' interlude for over 12-13 years but this is a great point.

There is a real opportunity to enlist real auditors, hard nosed, dedicated corporate and government types to put together a protocol that's fully informed by elections rights folks to find election fraud. Let them have at it.

Excellent post (and I can't believe you have another full time job...wow)

[garybeck]

22. yeah well I have to put bread on the table

(or food on my family)

and running a website is not exactly lucrative. :)

[Beam Me Up]

24. "What does it mean?"

I know you were being rhetorical. We all know what it means -- election fraud is a fact fact and this fact has been hidden from the American people to make them believe that THEY elected the people who are making the decisions that have chosen this course of history. That is what the media and everyone tells us -- WE did this. If anything goes wrong it is WE, indeed Democracy itself, that is 'responsible'.

I don't think so. Yes, I know, there are a lot of short-sighted, narrow minded, people in this country but I still don't buy it.

[calazini]

25. They don't want it to be audited

I have been an auditor my entire career - a member of AICPA, the IIA and ISACA. Voting machines cannot be audited because they are not 'designed' to be audited. Make no mistake, this is intentional (adjusting my tin foil hat....). Every system has the potential to be audited, but only if those controls are placed into the system. If the system is closed, the only audit you can perform is a code review (not very efficient, but it can be done). There should always be controls built into any system to ensure that the system is auditable. You can bet your ass that the Diebold ATMs are auditable without a code review. The banking system has even more strigent auditing requirements than Sarbanes Oxley and have had them in place for years. The Diebold ATMs would require regular audits and possibly even a SAS 70 (Service Auditors Review) to have Diebold have an independent firm come in and test the controls that they put into their ATMs.

The government isn't forcing this type of review on the voting machines because they don't want to. Many aspects of the government would require a SAS 70 report for things (systems, processes) that they outsource. They aren't forcing it because they know what will come of it. This type of closed system is entirely hackable; the control structure is not there. Thank God I vote on optical scan.:tinfoilhat:

[Cleita]

26. I've been saying this since the 2000 election, when I saw

first hand in my county how elections were done.Your auditor said:

"Fraud" she says, "you'd need audits on those systems to prevent Fraud."

I said, "Counting the votes only once,whether by machine or by hand invites cheating". Yet, this is the first time anyone has put up a post that actually points to the crucial core of the system and how elections can easily be rigged.

Thanks for making the explanation more lucid for those who need to understand why we need to change how we do elections to provide complete transparacy and proof of the counts.

[Bill Bored]

27. Hey Gary, all this time I thought you were a....

...bus driver!