Start Here
Donate

Case 7 — Butler County, 2008

7.1 — Introduction

On March 4, 2008, Ohio held its primary election. In at least eleven counties using voting equipment manufactured by Premier Election Solutions — formerly Diebold Election Systems — votes were silently dropped during the upload of memory cards from individual voting machines to the central tabulation server. The GEMS (Global Election Management System) software showed the uploads as successful. No error messages appeared. No alerts were triggered. The official results were simply wrong — lower than the actual vote count — and nothing in the system indicated a problem.

The discovery was accidental. Officials in Butler County, reconciling their vote totals after the primary, noticed that approximately 150 votes were missing. The Ohio Secretary of State’s office subsequently found the same problem in ten additional counties. At least 1,000 votes were undercounted statewide across the affected jurisdictions. (Brennan Center, 2010)

What followed was a four-month confrontation between a county election director who refused to accept a false explanation and a vendor whose first instinct was to deflect blame. Premier initially attributed the vote loss to conflicts with McAfee antivirus software. Butler County Election Director Betty McGary called Premier’s report “highly speculative” and demanded a real investigation. Only after the Ohio Secretary of State’s office conducted controlled simulations — which proved that the bug was in Premier’s own GEMS code, not in antivirus software — did Premier admit the truth: a logic error in GEMS had been silently dropping votes for approximately ten years.

This case study occupies a central position in the manual. Unlike the Gaston County case — where the system broke visibly and was repaired through transparency — Butler County demonstrates what happens when the system breaks invisibly. The votes were counted correctly at the precinct level. They were dropped silently during upload to the central server. The official results were lower than reality, with no self-announcing indicator that anything had gone wrong. Without Betty McGary’s persistence, the bug would have been present — undetected and unrepaired — for the November 2008 presidential election.

Actual Vote is designed precisely for this failure mode. Independent poll tape recordings at the precinct level would have shown the correct vote totals. The discrepancy with the officially reported results would have been publicly visible on election night — not four months later, and not dependent on any individual official’s willingness to fight a vendor.

7.2 — Background: Premier Election Solutions and GEMS

Premier Election Solutions was the new name for Diebold Election Systems, which had rebranded in 2007 after years of controversy over its voting equipment. The company manufactured both direct-record electronic (DRE) touchscreen machines and optical scan tabulators. Both types used GEMS — the Global Election Management System — as the central tabulation software that aggregated precinct-level results into countywide and statewide totals.

The reporting chain in a GEMS-based system works as follows. Voters cast ballots — either on a touchscreen DRE or by filling in an optical scan ballot. The voting machine at the precinct records the votes, typically on an internal memory card. At the close of polls, the precinct produces a printed summary tape showing the total votes recorded for each candidate — the poll tape. The memory card is then physically transported to the county election office, where it is uploaded into the GEMS server. GEMS reads the data from the memory card, adds it to its central database, and produces the official results.

The critical transition point — the one where Butler County’s votes were lost — is the upload from memory card to GEMS server. Everything upstream of that transition (the voter’s selection, the machine’s recording, the precinct-level count, the poll tape) was correct. Everything downstream (the GEMS database, the official results) was wrong. This is a reporting-layer failure: the votes were counted correctly but reported incorrectly.

At the time of the 2008 Ohio primary, about half of Ohio’s 88 counties used Premier equipment — approximately 44 counties that had collectively spent $83 million on the machines in 2006. Nationally, Premier’s systems were in use across 34 states. GEMS was not a niche product. It was one of the most widely deployed election management systems in the United States.

7.3 — What Happened: The March 2008 Primary

On the night of March 4, 2008, memory cards from voting machines across Ohio were transported to county election offices and uploaded to GEMS servers, following standard procedure. In Butler County and at least ten other Ohio counties, some of those uploads silently failed.

The failure mechanism was specific and insidious. When multiple memory cards were uploaded to the GEMS server simultaneously — or in rapid succession — a software error caused a “sharing violation.” In technical terms, incoming vote data from one memory card could overwrite or displace vote data from another card that was still being processed. The votes on the displaced card were not written to the GEMS database. They were simply lost. The entire process took milliseconds.

The GEMS interface provided no indication that anything had gone wrong. The upload status for the affected memory cards showed “successful.” The vote totals in the GEMS database were internally consistent — they simply did not include all the votes. There was no error log entry, no alert, no flag. An election official looking at the GEMS screen after all cards had been uploaded would have seen what appeared to be a complete, correct set of results.

Butler County officials discovered the problem only because they were reconciling vote totals from the March primary against other records — a routine quality-control step that not all counties perform, and that would not have caught the error if the discrepancy had been small enough to fall within expected variance. In Butler County, approximately 150 votes were missing. As Jeff Ortega, assistant director of communications for the Secretary of State’s office, later noted, the dropped votes “could have easily been overlooked.”

According to The Register, the only way to detect the error within the GEMS system itself was for election officials to “track the exact number of memory cards fed into the central database and compare it to the number of cards recorded as being read” — a manual reconciliation step that is not automated and not universally practiced.

The Ohio Secretary of State’s office, having been alerted by Butler County, investigated further and found the same problem in additional counties. The Brennan Center for Justice’s 2010 report states that at least 1,000 votes were undercounted in “nine of Ohio’s forty-four counties using Premier touch screen or optical scan voting systems.” Contemporary press coverage (Computerworld, Washington Post) reported eleven affected counties. The discrepancy may reflect different stages of the investigation or different criteria for what constitutes an “affected” county. Regardless of the precise count, the problem was not isolated to Butler County — it was a systemic failure affecting multiple jurisdictions using the same vendor’s software.

The larger counties were disproportionately affected. The bug was most likely to trigger when many memory cards were uploaded in quick succession — a scenario that is more common in larger jurisdictions with more precincts and more voting machines. This is a perverse dynamic: the counties with the most voters — where vote totals matter most — are the counties most vulnerable to this particular failure.

7.4 — The Vendor Response: Deflection and Delay

The timeline of Premier’s response is the most important part of this case study for understanding why independent verification — rather than vendor self-reporting — is necessary.

April 4, 2008. The Butler County Board of Elections sent a letter to Premier Election Solutions, notifying the company of the vote-dropping problem. The letter was copied to Ohio Secretary of State Jennifer Brunner.

April 9, 2008. Butler County sent a follow-up letter reporting that the problem had recurred.

May 16, 2008. Premier issued a report attributing the vote loss to two causes: antivirus software (specifically McAfee) running on the GEMS server, and human error by election workers. This explanation was false. The antivirus software was not the cause. Premier either knew this or should have known this — the logic error in GEMS had been in the code for approximately ten years, and similar symptoms had been reported by other jurisdictions.

May 23, 2008. Betty McGary, Director of Elections for Butler County, wrote to Dave Byrd, President of Premier Election Solutions. She called Premier’s report “highly speculative” and rejected their assumptions. She stated that she requested Premier continue to research and diagnose the root source of the discrepancies.

This letter is the turning point. If McGary had accepted Premier’s antivirus explanation — which was superficially plausible and would have been convenient for everyone — the investigation would have ended. Counties would have been told to manage their antivirus configurations more carefully. The actual bug would have remained in the GEMS code, undetected and unrepaired, through the November 2008 general election and beyond.

May 29, 2008 (approximate). Premier suggested that counties should disable their antivirus software to prevent the problem. This recommendation was remarkable for two reasons. First, it was based on Premier’s false diagnosis — if the antivirus software was not the cause, disabling it would not fix the problem. Second, disabling antivirus software on election management systems would contradict security best practices and potentially violate certification requirements. Premier was effectively asking counties to make their systems less secure in order to address a problem that Premier had misdiagnosed.

August 6-7, 2008. Butler County election officials and the Ohio Secretary of State’s office conducted a definitive test. Over two days, they ran eight simulations of the vote counting process, with Premier observers present. Some simulations were run with McAfee antivirus enabled; others had it disabled. The simulations were designed to isolate the variable that Premier had blamed.

The results were unambiguous. The machines dropped votes during multiple simultaneous memory card uploads regardless of whether the antivirus software was enabled or disabled. Premier’s antivirus explanation was not merely speculative — it was wrong.

August 2008. Confronted with simulation results that directly contradicted their earlier report, Premier conceded. In a letter to Brunner, Premier President Dave Byrd wrote: “We now have reason to believe that the logic error in the GEMS code can cause this event when no such antivirus program is installed on the server.” He added: “We are indeed distressed that our previous analysis of this issue was in error.” Premier spokesman Chris Riggall acknowledged that the company’s earlier analysis “was not complete,” but maintained that Premier’s machines were “a high-quality voting system that continues to operate in many, many Ohio counties with great success.”

Premier released a product advisory telling users of its machines how to avoid lost votes: poll workers needed to check the vote-counting servers to verify that all memory cards were shown as uploaded. The company also developed a fix for the logic error and submitted a new version of GEMS for federal certification. However, Premier acknowledged that the fixed version of the software would not be certified before November’s general election — meaning the bug would still be present, unpatched, for the presidential election. Premier notified approximately 1,750 jurisdictions across 34 states that used its equipment.

The gap between discovery (March 2008) and vendor admission (August 2008) was five months. During those five months, Premier provided a false explanation, recommended a counterproductive fix, and acknowledged the truth only when controlled experiments made denial impossible.

7.5 — The Root Cause: A Decade-Old Bug

The technical cause was a logic error in the GEMS server software that managed the upload of vote data from memory cards. When multiple memory cards were being read and processed by the server at the same time, a sharing violation could occur. In simplified terms: two data streams competed for the same resource in the server’s memory. One stream overwrote the other. The overwritten votes were not saved to the database. The entire collision occurred in milliseconds and produced no error message.

Contemporary press reporting (Computerworld, The Register) states that the logic error had been present in the GEMS software for approximately ten years. This means the bug was introduced into GEMS around 1998 — roughly the same year Gaston County, North Carolina experienced its data cartridge failures with DRE machines. The bug had been present through every election cycle — primary, general, special, local, state, federal — in every jurisdiction using GEMS for approximately a decade.

Security researcher Bruce Schneier, analyzing the admission on his widely-read security blog, raised a critical question that Premier’s disclosure left unanswered: whether the error was random or systematic. If the sharing violation dropped a small percentage of all votes randomly — regardless of which candidate they were cast for — then the effect on any individual race would likely be small, though still unacceptable. But if the error was systematic — if the timing of uploads correlated with the order in which candidates’ votes were processed, or with the size and political lean of the uploading precincts — then the error could have disproportionately affected one candidate over another. Premier’s disclosure did not address this question, and the available evidence does not resolve it.

How many votes were lost over those ten years is unknowable. The bug’s signature — a silent reduction in vote totals with no error indication — means that it could have affected any election in any GEMS county without anyone noticing, unless someone happened to reconcile the precinct-level counts against the GEMS totals. The fact that the March 2008 discovery was accidental — found during routine reconciliation in one county — suggests that prior instances likely went undetected.

The DuPage County, Illinois precedent supports this. The Brennan Center report documents that in 2004, a county election summary from DuPage County recorded a “GEMS Upload Failure” in which a memory card had a failed upload on election night. The upload was not detected until the next day, when reports showed zero results for each race within the precinct. The GEMS system had displayed the upload as “successful” even though the ballot count was zero. A technician noted it was “rather discomforting” that the failure was not detected on election night.

The DuPage County incident appears to be the same class of failure as Butler County — a GEMS upload that silently fails, producing zero or reduced vote counts, with the system showing “successful.” Whether the specific root cause was the same sharing violation or a related bug is not documented in the available sources. But the pattern — silent data loss during the memory card-to-GEMS transition, with no error indication — is consistent.

7.6 — The Aftermath

The lawsuit and settlement

In May 2008 — while the antivirus deflection was still the company’s official position — Premier filed a preemptive lawsuit against Brunner’s office and Cuyahoga County, seeking a judgment that the company had not violated any contracts or warranties in Ohio. In August, after the simulations disproved Premier’s explanation, Brunner filed a counter-claim in Franklin County Common Pleas Court accusing Premier of breach of contract, breach of warranty, and fraud. Brunner also sought to recover millions of dollars the state had spent on the touch-screen machines and urged the state legislature to require optical scanners statewide.

Brunner publicly praised the officials whose persistence had forced the truth: “It is the dedication of board officials such as those at the Butler County Board of Elections, who went above and beyond the call of duty, that gives me confidence that preparation with our local partners will lead to a successful November election.”

The case was settled in August 2010 — two years after the initial discovery. Premier agreed to pay 470,000incashto47Ohiocounties.Thesettlementalsoincludedupto470,000 in cash to 47 Ohio counties. The settlement also included up to 2.4 million in free software licensing, free replacement of up to 15% of the machines each county owned, and 50% discounts on maintenance fees and optical scan systems for counties that wanted to switch away from touchscreen DREs. Each county individually decided whether to participate in the settlement.

Project EVEREST

Separately from the Butler County investigation, Brunner commissioned Project EVEREST (Evaluation and Validation of Election Related Equipment, Standards and Testing) — a comprehensive security review of all voting systems in use in Ohio. The $1.9 million, ten-week study was conducted by research teams from the University of Pennsylvania, Pennsylvania State University, the University of California at Santa Barbara, Systest Labs, and MicroSolved, with the Battelle Memorial Institute serving as project manager.

EVEREST’s findings went far beyond the GEMS upload bug. The review found “critical security failures” in systems from all three major vendors used in Ohio — Premier, Hart InterCivic, and Election Systems & Software (ES&S). In some cases, voting machines could be compromised with everyday objects such as magnets or PDAs. The EVEREST report strengthened Brunner’s case for transitioning Ohio to paper-based voting systems.

The corporate aftermath

ES&S acquired Premier Election Solutions. ES&S subsequently sold Premier’s primary assets to Dominion Voting Systems as part of a Department of Justice antitrust agreement. Dominion was not party to the Ohio lawsuit or settlement. The chain of acquisitions did not eliminate the GEMS software or its successors from the election ecosystem — it transferred them through a sequence of corporate owners.

The regulatory gap

The Butler County case became a central exhibit in the Brennan Center’s argument for systemic reform of voting system oversight. The center’s 2010 report, “Voting System Failures: A Database Solution,” used Butler County as the lead case study and called for three reforms: better contracts between counties and vendors (with mandatory disclosure requirements), stronger state regulation (mandatory vendor reporting of known defects), and the creation of a national, searchable database of voting system malfunctions.

As of 2010, the Brennan Center found that voting machine manufacturers were not required to report malfunctions of most of their systems to any government agency. The EAC had only certified its first voting system in February 2009, and approximately 99% of U.S. jurisdictions in 2010 would be using equipment not covered by EAC certification or federal reporting requirements. Jane Platten, Director of the Cuyahoga County Board of Elections — Ohio’s largest election jurisdiction — stated that vendors “often know about the problems and never disclose any details whatsoever prior to the moment of crisis.”

Betty McGary herself advocated for mandatory vendor reporting: “voting machine vendors [should] report all malfunctions and complaints they receive from election officials to a central and searchable database,” noting that “such reporting should be mandatory.”

The Butler County case also shares a troubling feature with the Monmouth County, New Jersey incident fourteen years later (see Case 16 — Monmouth County, New Jersey, 2022): in both cases, official post-election audits reported no problems while documented errors persisted. In Monmouth County, the official audit reported “tabulation accuracy was 100%” while six flash drives had been double-counted — an error that changed the outcome of a school board race. In both cases, the audits tested the wrong thing, and independent investigation was needed to expose what official processes missed.

7.7 — What Actual Vote Would Have Caught

The reporting chain and where it broke

The Butler County failure occurred at a specific, identifiable point in the reporting chain:

  1. Voter casts ballot → Correct.
  2. Machine records vote on internal memory → Correct.
  3. Precinct produces poll tape at close of polls → Correct. The poll tape reflects the precinct-level count, which was accurate.
  4. Memory card transported to county office → No data loss during transport.
  5. Memory card uploaded to GEMS server → THIS IS WHERE THE FAILURE OCCURRED. The sharing violation caused votes to be dropped during upload.
  6. GEMS produces official results → Wrong. Lower than actual vote count.

AV’s methodology — video-recording poll tapes at the precinct level — captures the data at step 3, before the failure at step 5. The AV recording preserves the correct precinct-level totals. The official results at step 6 are wrong. The comparison between the AV-recorded totals and the official results reveals the discrepancy.

The alternate universe: AV deployed in Butler County, March 2008

Imagine AV volunteers are stationed at polling places across Butler County on March 4, 2008. At the close of polls, each precinct’s voting machine prints a summary tape showing the votes recorded for each candidate. AV volunteers video-record the tapes and upload the recordings to the AV public archive.

Within hours of the polls closing, the AV comparison analysis begins. The system compares the precinct-level totals from the recorded poll tapes against the official results published by the Butler County Board of Elections (sourced from the GEMS server).

The discrepancy is immediately visible. In the precincts where the GEMS upload failed, the official results show fewer votes than the poll tapes. The sum of all AV-recorded precinct-level totals exceeds the official countywide total. The magnitude of the discrepancy — approximately 150 votes in Butler County — is large enough to be unambiguous.

The AV analysis does not need to know why the discrepancy exists. It does not need to diagnose the GEMS sharing violation. It does not need to understand the difference between an antivirus conflict and a logic error. It simply shows: the poll tape said X; the official result said Y; X ≠ Y. That fact alone — publicly documented, independently verified, and available on election night — triggers the investigation.

Now compare this to what actually happened. Without AV:

  • March 4: Election night. Nobody knows votes have been dropped.
  • Weeks later: Butler County officials discover the problem during routine reconciliation.
  • April 4: Butler County notifies Premier.
  • May 16: Premier blames antivirus software. If the county accepts this, the investigation ends.
  • May 23: McGary rejects Premier’s explanation and demands a real investigation. This is the critical moment — one person’s professional judgment preventing a false resolution.
  • August 6-7: Simulations finally prove the true cause.
  • August 2008: Premier admits the truth — five months after the election.

With AV, the discrepancy is publicly visible within hours of the polls closing. The five-month delay between election night and vendor admission is compressed to election night itself. McGary’s role — which in reality was indispensable — becomes unnecessary, because the independent evidence exists whether or not any individual official chooses to investigate.

What AV would not have caught

AV’s detection depends on whether the affected precincts produced printed poll tapes. Both optical scan machines and most DRE machines produce end-of-day summary tapes, so this is a reasonable expectation for the equipment in use in Butler County in 2008. However, if any precinct’s machine failed to produce a tape — or if a tape was produced but not recorded by an AV volunteer — that precinct’s discrepancy would not appear in the AV dataset.

AV also would not have diagnosed the cause. AV can show that official results differ from precinct-level counts; it cannot determine whether the difference is due to a software bug, human error, or deliberate manipulation. The diagnosis would still require the kind of investigation that Butler County and the Ohio Secretary of State conducted. But the investigation would have started on election night, not weeks later, and it would have begun with publicly documented evidence of the discrepancy rather than a county official’s internal reconciliation.

The November 2008 counterfactual

The most consequential implication of this case is what could have happened if the bug had not been discovered before November 2008. Ohio was a critical swing state in the 2008 presidential election (Obama vs. McCain). About half of Ohio’s 88 counties used Premier equipment. The GEMS sharing violation affected larger counties disproportionately — exactly the counties where vote totals matter most in a statewide race.

Even with the bug discovered and acknowledged, Premier admitted that the fixed version of GEMS would not be federally certified before November. The only mitigation available was the manual workaround in Premier’s product advisory: election workers had to manually track the number of memory cards uploaded and compare it to the number recorded as read. This workaround depended entirely on local officials knowing about it, understanding it, and executing it correctly under the pressure of election night — the very conditions under which the bug was most likely to trigger.

If McGary had accepted Premier’s antivirus explanation in May 2008, even this imperfect workaround would not have existed. The bug would have been present, unacknowledged, and unmitigated for the November general election. The higher turnout of a presidential election — producing more memory cards to upload simultaneously — would have made the sharing violation more likely to trigger, not less.

We cannot know whether the bug would have changed the outcome of any race. But we can know this: AV deployed across Ohio’s Premier-equipped counties would have detected any vote loss on election night, regardless of whether a Betty McGary existed in every county. The structural guarantee matters most when the stakes are highest.

7.8 — The Regulatory Vacuum

Butler County illustrates a systemic failure that extends beyond any single vendor or any single bug. The election system’s quality assurance, as of 2008, depended almost entirely on vendors voluntarily disclosing problems with their own products. There was no mandatory reporting requirement. There was no independent monitoring. There was no searchable database of known malfunctions. Election officials relied on the vendors — the same companies that had financial incentives to minimize or conceal problems — as their primary source of information about whether the equipment was working correctly.

The Brennan Center’s 2010 report documented the scope of this vacuum:

  • The EAC’s certification program covered less than 1% of voting systems in use nationally as of 2010.
  • Mandatory vendor reporting to the EAC was required only for EAC-certified systems during federal elections — excluding the vast majority of equipment and elections.
  • Vendors were “frequently under no legal obligation to provide” information about defects to election officials.
  • Independent investigators and voters with credible reports of problems were “not entitled to report problems” through any official channel.
  • Even where vendors did notify officials, the information was often vague. In the Humboldt County, California case — involving the same GEMS “deck zero” bug — the vendor sent “a vague e-mail” recommending a “workaround” without identifying the problem or the potential consequences of not implementing the workaround.
  • A change in election administration personnel could mean a loss of institutional knowledge about known problems, because there was no centralized record.

Premier’s behavior in the Butler County case is a direct illustration of what happens in this regulatory vacuum. The company’s first response to a documented vote loss was to blame something other than its own software. Its second response was to recommend a fix (disabling antivirus) that would not have solved the problem. Only when confronted with experimental evidence — generated not by the vendor but by the county and the Secretary of State — did Premier acknowledge the truth.

AV operates entirely outside this vendor-official relationship. It does not depend on vendors to report their own bugs. It does not depend on the EAC to certify and monitor equipment. It does not depend on election officials to perform reconciliation checks that may or may not catch silent failures. It provides independent, publicly held, precinct-level evidence that any discrepancy between the precinct count and the official result will be detected — regardless of the cause, regardless of the vendor’s response, and regardless of whether any individual official chooses to investigate.

In the Brennan Center’s framework, the policy solution is a national database and mandatory vendor reporting. This is a valuable reform, but it operates within the existing institutional structure — it requires vendors to comply, agencies to maintain the database, and officials to use it. AV provides a complementary structural guarantee that operates independently of all institutional actors: evidence that exists in public hands, is created at the point where the data is still correct (the precinct), and cannot be suppressed or withheld by any party.

7.9 — Why It Matters

The Butler County case matters for this manual for three interconnected reasons.

First, silent failures are the most dangerous category of vote reporting vulnerability. Gaston County’s 1998 failure was dramatic — a third of precincts reported zero votes, and the tabulation capped at 32,000. The failure was impossible to miss. Butler County’s failure was the opposite: votes disappeared silently, the system showed “successful,” and the official results looked internally consistent. If Butler County officials had not performed routine reconciliation — a step that is not universal and that could easily be skipped under time pressure — the vote loss would have gone undetected. A failure mode that is invisible to the people operating the system is a failure mode that cannot be corrected by training, procedure, or vigilance alone. It requires independent verification.

Second, vendor incentives are structurally misaligned with transparency. Premier’s response to the Butler County discovery followed a predictable pattern: deny, deflect, minimize. The company blamed antivirus software — a plausible-sounding explanation that, if accepted, would have absolved Premier of responsibility and left the actual bug in place. Premier recommended disabling antivirus — a step that would have made systems less secure while failing to fix the problem. Premier admitted the truth only when controlled experiments made denial impossible. This is not a story about a uniquely bad company. It is a story about the incentive structure that any vendor faces when its product is shown to have a defect: the incentive is to minimize the problem, protect the brand, and avoid liability. Independent verification neutralizes this incentive structure. When the evidence of a discrepancy is publicly held and independently generated, the vendor cannot control the narrative.

Third, the system’s only safeguard was one individual’s professional integrity. Betty McGary’s refusal to accept Premier’s “highly speculative” explanation is the single decision that prevented this bug from reaching the November 2008 general election undetected. If McGary had been less experienced, less persistent, or simply less willing to fight a vendor that was pushing back — and if the Ohio Secretary of State had not supported the investigation — the sharing violation would have continued to silently drop votes in 34 states. AV does not depend on the existence of a Betty McGary in every county. It provides the independent evidence that makes the discrepancy visible regardless of whether any individual official chooses to investigate. The structural guarantee — evidence that exists in public hands, created at the precinct level, before the data enters the system where it can be lost — is what makes AV’s protection systematic rather than dependent on individual heroism.

7.10 — Further Reading

Primary investigative analysis

  • Lawrence Norden, “Voting System Failures: A Database Solution,” Brennan Center for Justice, 2010. The most comprehensive single account of the Butler County incident, with footnoted references to the McGary–Premier correspondence, the simulation results, and Premier’s admission.

Contemporary press reporting

Settlement

Project EVEREST

  • Jennifer L. Brunner, Ohio Secretary of State, “Project EVEREST: Evaluation and Validation of Election Related Equipment, Standards and Testing” (December 2007). $1.9 million security review of all voting systems in Ohio.
  • Matt Blaze, “Ohio Voting Security Review Released” (blog post, 2007). Summary of EVEREST findings.
  • DuPage County, Illinois, 2004. GEMS upload showing “successful” with zero ballot count. Cited in Brennan Center report, Appendix C.
  • Humboldt County, California, 2008. GEMS “deck zero” bug causing silent loss of approximately 200 absentee ballots. Brennan Center report, pp. 12–13.