NYC Board of Elections Can't Buy Credibility Even if it Were Possible
NYC Board of Elections Can't Buy Credibility Even if it Were Possible
After disenfranchising 200 thousand voters in 2016 – and settling the lawsuit – the NYCBOE outsources its functions to the private sector, for $24 million, rather than reform
UPDATE (10/31/2021): A new document from the NYS Department of Homeland Security and Emergency Services was added, and a marked update was added to this writing.
The Documents:
Comptroller’s Office Contract Registration Cover Sheet and Financial Management System Records
NYS Department of Homeland Security and Emergency Services ePollbook Testing Reports
When New Yorkers head to the polls next month there will be one pressing question on everyone’s mind: why the heck am I being forced to sign an ipad to vote? The short answer is: because after the New York City Board of Elections’ embarrassing failure to administer the 2016 presidential primary ethically – over 200 thousand New Yorkers illegally disenfranchised, skewing the election results – the NYCBOE had to do something. That something was the transfer of $24 million and rising in public funds to the private actor KNOWiNK, which powers its technical infrastructure on Amazon Web Services.
Rather than just doing its job it was supposed to do in the first place, the NYCBOE decided to abdicate a core part of its electoral duty – maintenance of the poll books, and the printing of paper ballots – to the private sector. Amazon now has a privileged role in the administration of New York City elections. Verizon does too. And the underpaid staff who actually work on the frontlines of our elections will continue to be underpaid, even as the government saw fit to invest $24 million not in its own faltering organization, but in a Saint Louis tech firm.
The NYCBOE’s violations in 2016 were so egregious, that the New York State attorney general intervened in a lawsuit filed by voting rights groups against the agency – intervened by validating the complaints and even levying new allegations. According to the press release announcing the legal action, the attorney general found “new evidence that shows both explicit violations of the law and that high-level officials at NYCBOE had knowledge of these violations.” The attorney general also discovered what the NYCBOE called the “Brooklyn Project,” which illegally cancelled over 117 thousand voter registrations. At one point NYCBOE was even consulting ancestry.com to purge voters – very illegal.
A timeline of the NYCBOE’s “Brooklyn Project,” which illegally purged over 117 thousand voter registrations. From the New York State attorney general.
“The Brooklyn Project was illegal under both the National Voter Registration Act (“NVRA”), 52 U.S.C. § 20507(b)(2), and the New York Election Law, N.Y. Elec. Law § 5-400,” the press release read. “In spite of this clear prohibition, the NYCBOE proceeded with the Brooklyn Project, and for several months in 2014, more than 20 employees worked diligently to flag voters for cancellation based on the illegal criterion.”
Despite the serious accusations of systematic antidemocratic practices, the settlement was toothless, and the NYCBOE lived another day – to hand out giant piles of cash instead of fixing its problems.
The original contract signed over to KNOWiNK by the NYCBOE began in July 2019 and expired in June of this year, with the option for a two-year renewal “under substantially the same terms and conditions.” Meaning, by now the NYCBOE has consigned even more public money to this private entity.
KNOWiNK is a tech firm that licenses election software and sells ipads to governments all over the country. They often copy-paste the same contracts between clients – in at least one instance KNOWiNK refers to New York City as “the City of Philadelphia.” Blatant disrespect aside, KNOWiNK doesn’t even own its client-facing servers, instead leasing them from Amazon – the network infrastructure oligopolist which has become the de facto most powerful actor on the internet.
Timelines from the New York State attorney general documenting NYCBOE illegally purging another 104 thousand voter registrations.
Big Money, Cheap Security
Before the NYCBOE signed away its functionality to KNOWiNK, there was only one obvious single point of failure: the NYCBOE itself. Now there are many more single points of failure. Not only are elections dependent on the NYCBOE, but also on the internet, the cellular phone network, the electric grid, proprietary software, and proprietary software licensing. That’s a huge increase in the attack surface area just to avoid reforming the NYCBOE.
But is the system secure? Inherently, no internet-connected system is truly secure. But there are mitigations that can be taken to decrease that insecurity. The NYCBOE seems to have taken the bare minimum, however.
The assessment of KNOWiNK’s security was undertaken by two actors: the New York State Department of Homeland Security and Emergency Services, DHSES, performed a vulnerability scan on the ipads and other hardware; the private company NYS Technology Enterprise Corporation did a vulnerability scan on KNOWiNK’s public internet endpoints – the points of entry for the NYCBOE’s necessary interactions with KNOWiNK.
This might sound convincing to state bureaucrats. But the fine print in the state’s Vendor Assessment Report acknowledges that NYSTEC’s scans were “basic network and web application scans … with defaults enabled,” and that “manual application testing, penetration testing and other security testing were not in scope.” Meaning, that for the NYCBOE’s $24 million biannual budget for KNOWiNK, they could not afford to pay an actual person to actually try to break into the multi-million dollar system powering all of New York City’s elections. It just wasn’t in scope!
UPDATE 10/31/2021: Inspiring even less confidence in KNOWiNK’s security, the DHSES report on their limited security assessment states, “this report does not make any conclusive statements as to the overall security posture of the various vendor ePollbook submissions and technical solutions.” In the FOIL appeal response letter granting redacted access to this report, DHSES insists that it’s “Cyber Incident Response Team” – a division of the DHSES Office of Counter Terrorism – “consists of highly trained cyber security experts and provides security support and analysis.” And yet the DHSES’s own website has had an invalid HTTPS certificate for over a month – they have yet to fix this basic security error even after being notified about it 10 days ago.
Amazon: Captain of Everything
I must confess: it is usual for software firms to lease their infrastructure from Amazon. Amazon’s seat of power relies precisely on just how common and socially acceptable the practice has become. And perhaps this is not always a negative practice. But there are different requirements for, let’s say, operating a social network, or a news website, or an online store front – and administering elections in the largest city in America. The first category is relatively harmless – who cares if Amazon has become the global digital distribution network for all the newspapers? – but allowing Amazon to be a direct operator in the electoral process is a risk that society should not accept – no matter how small you think that risk is, and no matter how many Amazon marketers have convinced the professional classes that their oligopoly is great and fair.
Actually, Amazon shouldn’t have any role in elections at all – not even to source the blank paper the ballots are printed on. This should be as obvious as it is why the Rockefellers and the Vanderbilts weren’t allowed to conduct public elections in the era when the working classes still had the sense to call them “robber barons.”
I am not making an innuendo here that Amazon is corrupt and would interfere with our democracy – actually this is pretty well documented, since they spent $18.6 million on lobbyists last year – but merely stating that the electoral process can not afford any vulnerability of any kind, and not one so avoidable as giving Amazon the keys to the castle.
Unlike American banks, the tech oligopoly is not “too big to fail.” Earlier this month Facebook suffered an embarrassing total global infrastructural outage causing their organization to be completely offline for a quarter day. That was great. But what if Amazon goes down on election day? Even if Amazon doesn’t go down, the mere presence of its brand is not a guarantee of security or availability. Actually, the safe operation of its infrastructure rentals is entirely up to the competency of its renters – which is a huge if. Amazon Web Services is so complicated to maneuver that its customers routinely leave themselves completely unsecured. Not only does AWS give you the power to deploy complex networks, it gives you the power to do so very very poorly.
This is not a theoretical problem. Last year, while investigating this story, I found by accident a big name government contractor leaking an entire terabyte of their government clients’ documents – small towns, counties, and cities from all over the country. Do those governments even have a clue? Was there any business consequence for the contractor?
Declining Faith in Elections as a Function of Government
Election integrity is more important for democracy than even elections themselves. As a matter of fact, even North Korea has elections. The mere existence of an electoral bureaucracy is not proof of an effective democracy. Actually credible elections are the bedrock of a true democratic republic.
And yet, the rejection of election integrity has become a bipartisan political tactic for at least twenty years in this country. In 2000 George Walker Bush was said to have stolen the state of Florida. In 2004 it was said again that Bush’s victory was rigged, with 32 Democratic Party members of Congress voting to decertify the election results of Ohio. In 2008 Barrack Hussein Obama II was outrageously and absurdly accused of not even being a United States citizen, and therefore ineligible to run for office. In 2016 when Donald John Trump pulled off the surprise electoral victory of a century, it was said that he was actually an agent of Russian intelligence, and that Владимир Владимирович Путин himself had brainwashed an entire population to elect his puppet. In 2020 when Joseph Robinette Biden Jr. defeated Trump, the infamous slogan “Stop The Steal” was coined, and a few thousand of his supporters stormed the United States Capital.
Whether or not you believe any of these conspiracy theories about how every president in the past twenty years won by fraud is beside the point. The point is, that it is unhealthy for a democracy when the integrity of its elections is in question – rightly or not – and bad things happen when there are electoral doubts. Why should our elections be beholden to public faith in Amazon when the last election outcome – disputed on the flimsiest evidentiary grounds – caused riots that made the federal government very embarrassed and left multiple people dead? If Amazon becomes a regular fixture in American elections, what is going to happen when the next Trump disputes their electoral defeat on the grounds of Amazon’s corruption? What if that charge isn’t even false?
Let’s not even go there. Let’s just secure the elections and stop dogpiling public money onto private actors that do nothing but raise electoral doubts. If there is an electoral bureaucracy that is failing then it should be reformed – or dismantled and replaced. KNOWiNK’s business dealings with the NYCBOE shouldn’t inspire any confidence that the government is actually doing its job now. Money isn’t the solution when the problem is bureaucratic rot.
John Bolger is a software developer and systems administrator.
This is a cross-post with DocuDrop NYC, a sister publication to S’Now’Den.
Illustration by John Bolger. Fair use imagery from: Blue Origin, Amazon Web Services, KNOWiNK, Federal Reserve Bank, and New York City Board of Elections. Note: only 0.4 percent of actual money wasted is shown.