Deputy Kelleher: It gave a tremendous result.
Deputy J. Brady: There is no doubt that the result was tremendous. It came of course after a professional campaign. As I said before, the only problem involved the suddenness of the result on the night. It was suggested we should have had the results count by count.
I have the height of confidence in the system. The constituency turnout exceeded all our expectations. I must compliment the people from the Department of the Environment, Heritage and Local Government who organised demonstrations in the towns and villages. This was a great help to people prior to the system coming into operation on the day of the election. I cannot understand why people should be afraid of the system. We must move on with new technology. The system was very successful for all the parties.
Deputy McCormack:What about John Farrelly?
Deputy J. Brady: He lost, but another Fine Gael member won. There was no loss or gain there. There was no computer error. I have the height of confidence in the system.
Mr. McCarthy: It strikes me as extraordinary that a system of this importance, which goes to the heart of our democracy, would be put into production without testing. I am speaking of the European elections. There is a dramatic difference in the volume of votes to be run through the system. It begins to stretch precisely those elements of the Access database technology with which the Department is sticking. Nathean's comments on the merits of the Access database did not rebut the point I made that Microsoft itself recommended against using it for critical systems that require recovery and integrity.
This will be a very large count. The Department is proposing not to test it because it is similar to a Dáil count, though not the same. The rules are the same, but from the computing point of view it is eight to ten times more onerous on the computer, and on the tables and their indices. We have not mentioned referential integrity and other matters pertinent to the insides of the Microsoft system. Nobody in those systems with which I am familiar in Dublin over the past ten years, systems on which we spent between €2 million and €12 million designing and implementing, ever used Access. We always use Sequel Server or Oracle. Nobody uses Access. I can provide chapter and verse in due course. At the very heart of a large count of 450,000 or 500,000 votes, to use Microsoft Access is foolhardy.
Deputy Cregan: I wish to endorse what Deputy Brady said. It is very important that all the committee members are given the opportunity to raise their queries and get the clarification necessary. That has been done not alone today but on previous occasions. The longer we continue to raise doubts and fears the more we raise and create them in the minds of the public. What we should do is roll out our PR wagon to every constituency in the country, educate the people, advise them and train those who will operate the system. There must be a certain level of trust in every system. After the last general election, during which the votes of three constituencies were counted electronically, there were no complaints. The only complaint involved the presentation of the results, a problem that has been rectified. Nobody raised any of the fears or doubts raised at this committee meeting today. There was no difficulty. Nobody questioned the results regarding those elected. That is the bottom line. People were elected through the system and I have no doubt that the paper trail would have shown the same result.
It is time we moved on, and allowed the Department and the Minister to carry out their business.
Chairman:We shall decide later how to proceed.
Deputy Maloney: I support what my colleagues, Deputies Brady and Cregan, said. I take the point made by the Secretary General about the spoiled votes. That is a matter we should be trying to rectify. We come back to the issue of trust. We must prove that the system can work. Mr. Steentjes made the point some time ago about boarding an aeroplane. By coincidence, I am thinking back to when Ms McGaley's uncle and I worked in air traffic control in the 1970s. At that time the system was based on primary radar in Dublin Airport. It was a paper trail. The primary radar depended on the signal coming back from the aircraft to the beacon on the airfield. That was backed up by a paper trail with the aircraft speed, direction, altitude and wind velocity. We moved from there to secondary surveillance radar, which involves no paper trail. There was a huge element of trust in doing that, far more important than in the voting procedure. This specifically made the point. The trust of the flying public was transferred to the specific person, namely the air traffic controller, dependent at that point on second surveillance radar once the switch was made. The paper trail was abolished. I suggest that system is now much safer. It comes down to the specifics of trusting the system. I will share similar trust in electronic voting.
Mr. Cochran: Deputy Gilmore asked if we could trust the accuracy of the votes cast. This touches on many of the issues raised this morning and at previous meetings. Deputies will recall the election of Deputy Dick Spring in North Kerry some years ago when after several recounts he was elected on a four-vote margin. If this system gives a result like that, would we trust it? Can we be sure that it is precise to within two, three or four votes, because we have had such outcomes in recent years? From what I have heard, I know of no way of verifying that we can be sure. The software being used in the counting has not been tested to the same level. Examples have been made of software running aircraft. This software has not been tested to the same level to which aerospace software is tested and verified. I have some experience of developing satellite and other avionic systems and know it is time-consuming, expensive and complex. I am not aware this has been done and it needs to be. Someone made the point that one has to trust the system when one boards an aeroplane to fly somewhere. If I knew the aeroplane used something like Microsoft Access I would not be happy to get into it. It probably would not matter, but if it was at that level of technology I would echo what Mr. McCarthy said as a computer professional. If I was developing systems this complex I would not use Microsoft Access. It is good and useful for small-scale home or non-critical systems, but it is not to be used for this type of project.
In answer to Deputy Gilmore's question, there is no way of knowing the accuracy. The only way is that made in a point by another speaker, in a somewhat different context, namely that in the Netherlands and Germany they are happy that it has worked consistently. However, I would stress this is in a slightly different context because the voting rules are not identical. The system is not identical and therefore that experience is not a precise test for what is happening in Ireland.
Deputy Kelleher: I too share some of the sentiments voiced by Deputies Cregan and Moloney with regard to trust and confidence in the system and the need to encourage people to take part in the system and become more aware of what electronic voting seeks to achieve with regard to efficiency and safety. Something has been missed here and I just wish to raise the issue. The voting machine is expected to be accurate to 100% all the time. Our present electoral system is not as accurate as we would like to think. The voting and transference of surpluses is based on a bundle as opposed to full recounting. I was involved in a recount myself and most recounts are not that at all, they are rechecks. A full recount would require all the ballot papers to be redistributed throughout the various pigeonholes and various transfers to be made. If that were done perhaps there would be a very different result. That is a fact of life. The computer system is much more accurate than that. The present electoral law does not allow for a full recount. It allows for a recheck. It is well known that given the vagaries of transfers and surplus distributions there could be a different result next time around. That is why the electoral law does not allow a full recount. We are asking the people to put their trust in a computer system that is more accurate while the law is actually allowing for the inaccuracies in the current paper system.
Deputy Morgan: I am sorry I missed the early part. I was involved in voting, electronically too. I would be much happier with this machine if it could guarantee the abolition of personation for all time. Someone was telling me about it over on these benches. I wonder if computer people fully appreciate the shenanigans that go on and the lengths to which candidates will go to try to get elected to the Oireachtas. In my own constituency, Louth, just fewer than 700 votes were spoiled, a significant percentage of which was because the presiding officer had not stamped them. That had a major potential to change the result. It did not on the day because the numbers were greater than the 700. However, in a tight situation it could have made a difference. We have heard about former Tánaiste, Deputy Dick Spring. The Minister for Communications, Marine and Natural Resources, Deputy Dermot Ahern, won an election in Louth by six votes. I lost an election a few years ago by 11 votes. When it comes down that level this is important. I have a question about the machine. Mr. Steenjes told us that it is sealed, but is there not a port on it for a cable, for relaying the message to the main counting device?
Mr. Steenjes: There is not.
Deputy Morgan: There is no facility. Does it have to be physically opened to that?
Mr. Steenjes: Yes. It can be compared to a calculator. What can be tampered with on a calculator? How can it make one plus one equal three?
Deputy Morgan: A final question: assuming there cannot be a printout of this, perhaps it is because a big ballot paper is anticipated of the type we are accustomed to. Why is there a difficulty in creating a much smaller paper system, similar for example to a cash register receipt? What is the difficulty in creating that, at least on a trial basis over several elections, to convince people that this is real?
Mr. Groenendaal: I have a videotape of an election in Belgium where a system was tried out with a paper trail within a small printer like a cash register. It was behind the screen so one did not get an original of each sheet but one could read and confirm what one had written. It was then cut off and fell down into an enclosed ballot box. It took a week before the first announcement in the national news that the try-out had failed because there was a difference between the electronic storage system and the papers.
Deputy Morgan: Was it much?
Mr. Groenendaal: It was announced, but it was in the news every week that research was ongoing. It took a week, only in one small precinct, to establish the manual count to make a comparison, because it was a combined election. It was on small pieces of paper and it came out every time according to the norms practised in paper systems with a different result. Statisticians will confirm that if there are ten recounts and one of them differs and an eleventh shows a different result again, there is no proof at all. It is nonsense to consider such a situation. In the video there was a video jam. At a certain moment the paper did not transport well and everything was scrambled up. If this is what is in store for the future, I think I will learn another trade.
Mr. McCarthy: Deputy Morgan mentioned that the primary source of spoiled ballots was the lack of punching with the official stamp by the presiding officer. In any new electronic system, that is entirely eliminated. The vast bulk of lost votes, therefore, will not arise for that reason. It would be interesting, as Deputy Gilmore requested, to see the statistics from the Department of the Environment, Heritage and Local Government on the analysis of such spoiled votes. Those votes will be entirely retrieved by an electronic system. I support electronic systems in general provided they are implemented properly and safely.
One aspect of this system bothers me greatly. This folder contains the only 14 pages of documentation from Powervote - I believe Groenendaal are behind Powervote - which are technical matters relating to how the counting software works. There is a big document for the returning officers, on how to run the screens and so on. This is the only technical documentation describing the software development of the counting along with the equally large and complex software development of the election management system for registering the polling stations and candidates, printing the ballot papers, preparing the ballot modules etc. They are two enormous pieces of software and, as far as I can formally ascertain, the Department has no documentation on these matters whatsoever as I have not had any response to five requests under the Freedom of Information Act and two internal reviews. It begs the question as to how the Groenendaal Company developed this software. My first query: how many people in the Groenendaal company work on this software and how many people in the Powervote and Nathean companies have seen it? Has anybody in the Department seen it? If my understanding from reading the files is correct, there are six people in the world who know how the Irish counting system will work. To my knowledge, none is endorsed with accreditation or certifying agencies. What software accreditation is being brought to bear on this system by the Department and its experts?
Ms McGaley: In response to Deputy Kelleher, on the difference between recounting and rechecking, there is a difference, but according to the law that is not an inaccuracy in the system. Currently the electronic counting works exactly the same way and one cannot recount, only recheck. It will be possible to implement recounts in the future but it has not been implemented yet. Errors in the all paper system affect one constituency once, whereas an error in the electronic system might affect the whole country every time the system is used. The big difference between the electronic and paper systems, is that an error that changed the workings of the voting or counting machines would affect every count every time the system was being used. In response to Deputy Maloney's query, the fundamental difference between an air traffic control system and an electronic voting system is that in general no one is interested in subverting the air traffic control system and we do not have to fear that someone will try to tamper with it in such a way that it will not work properly.
Deputy Cregan: Who are you suggesting would want to change the voting system?
Ms McGaley: We have to assume that people would want to change it. We live in a real democracy where people's votes are counted but who is to know what will happen 20 years down the line? The power of democracy is that if the wrong people are elected we can get them out again.
Deputy Cregan: Is Ms McGaley suggesting that this cannot be done with electronic voting?
Ms McGaley: I am suggesting the possibility exists that someone would want to subvert our electronic voting system.
Deputy Cregan: Could someone subvert the present voting system?
Ms McGaley: It would be much more difficult.
Deputy Cregan: Would it not be possible for someone in a van or car to pick up ten or 20 ballot boxes?
Ms McGaley: If 20 ballot boxes went missing, that would be noticed
Deputy Cregan: We will have an overall majority by then, so there will be no need.
Senator Brennan: It has been mentioned widely that the introduction of electronic voting with the purchase of 7,000 machines will cost €60 million. It has been widely speculated that storage of the machines will cost up to €4 million each year and, taking an average ten year lifespan for each machine, it will cost €100 million. What is the machine lifespan and how will the replacement be organised? During the ten-year period there may be two general elections, two local elections, and EU elections, and I wonder would £10 million per annum for electronic machines be considered good value for money? What are the estimated costs for the provision of staff for elections? Will more staff be employed on election and count days?
Deputy Gilmore: This is a question for Mr. Groenendaal, if someone was determined to corrupt the software for the counting, how would you prevent that happening? Has Mr. Groenendaal considered the possibility that somebody employed in his company could lie low for a couple of years and then do what he intended to do?
Mr. Groenendaal: I see as a positive one of the minor negative points Mr. McCarthy mentioned, that only a small group of people is involved in the development phase of the software, and the possibility of widespread running around with it does not exist. The software is under constant development, as it is not made once, frozen and used for the next 20 years. For every election, we deliver a so-called production version that is used in the following election, and we do so at the latest possible time before the election. That version has the last mark of the testers and is in the custody of the Home Office in Holland. In Germany it is in the custody of the Oberburgermeister of Cologne, for the moment, but that will alter. A similar procedure will be in use here.
Deputy Gilmore: Is Mr. Groenendaal saying that at each election, his company at the last minute redesigns....
Mr. Groenendaal: Not at the last minute; the latest possible date counting back from the election day
Deputy Gilmore: How do we know that Mr. Groenendaal's company has not made a faux pas?
Mr. Groenendaal: We deliver it to the customer and he gives the order as to the last phase, there is an iterative process of development and there is a moment when we say that we hold the status of the system at this moment and we go into the next election with this version. It makes it rather difficult for bad-minded people to tamper with the software.
Deputy Gilmore: If I wanted to get a particular result in an Irish election - as we saw in "The Gangs of New York", the people who decide the election are the people who count the votes - and I decided to find the way the votes are counted, as I need to doctor the software somehow, I would plant a good computer expert in Mr. Groenendaal's company to work on it. How would Mr. Groenendaal stop that?
Mr. Groenendaal: I am very careful in choosing the personnel in my company. It is rather simple if something like that happened; it would happen only once. I have a reputation beyond Ireland in the election software field since 1982 and my capital is my reputation. If someone intends to interfere with the software I am the first one to deal with it.
Deputy Gilmore: It would not be impossible to do it.
Mr. Groenendaal: No, but again there is the testing procedure of the software.
Mr. Callan: The final version of the software for a particular election, which Mr. Groenendaal will develop, will represent the culmination of all the efforts we have made - I referred earlier to continuous improvement - in the previous year in dealing with the company. It is not something they will produce from cold, so to speak; rather, it will be the accumulation of all efforts to improve the software up to that point. The software will then be delivered to us. There will be space within the schedules we have established with the company, for the Department to procure independent verification and testing of that software. We will do that before we commit the machines and other software to the actual business of the elections.
Deputy Gilmore: We are talking about software that is dealing with the count. How does one test the count software when one is not conducting a count? Presumably, this will be a month or two before an election.
Mr. Callan: Mr. Pugh is involved in reviewing the architecture and in the overview. Of course, we are not conducting a count; we are verifying the architecture and accuracy of the whole system that is employed.
Mr. Pugh: On the question of tampering, I have knowledge of the database and the source code, which are two obvious areas in which the potential for this sort of corruption could occur. The review status would identify those. If there were tampering of the source code to distribute votes in a certain way or to alter the result, it would be quite obvious because it would be in the source code.
Deputy Gilmore: We do not have the code.
Mr. Pugh: We do.
Deputy Gilmore: We do not.
Mr. Pugh: Sorry, I will qualify that - I do have.
Mr. Callan: I am sorry to cut across Mr. Pugh but I would like to explain because the Deputy has already mentioned the source code. The Department has full access to the source code and its agents - in this case, Nathean Technologies - have access to it. The Department is legally responsible for the proper conduct of elections. We have to take this responsibility ourselves and to discharge it conscientiously. We are doing that through the use of competent agents who will second-guess and test things.
It is another matter, and one for legitimate policy debate, whether or not it is desirable to put the source code into more general circulation so that other people can conduct their own tests on it. It is fair to say that there are arguments for and against that sort of concept. I do not have a strong position but in terms of the integrity of the whole process it is important and there would be arguments for and against. There might also be an argument that constructive and well-meaning technical experts outside our sphere could add value to the source code if they picked up some minor things. They are part of the argument in favour of letting out the source code. However, there are significant security considerations against letting out the source code at all, which one would have to consider.
The Department has full access to the source code, and so do its agents, which allows us to conduct tests under our responsibility to the Oireachtas to guarantee assurance for the system.
Ms McGaley: If the software is continually changing, and so the software used in election B is different from that used in election A, was the software used in election A faulty? If not, why is it being changed?
According to Mr. McCarthy's research, the code review involved reviewing 500 pages of codes a day. I know that in reading code it is very difficult to find bugs. As I said the last time I was here, even NASA which has incredibly careful code development systems, expects to have bugs. If 500 pages of code per day are being reviewed, the chances of finding something that is carefully hidden are very low. It is possible to hide carefully what we call, "Trojan horses" and such things. Therefore, if something is hidden carefully, it is possible that it would not be found by a code review.
Mr. Cochran: I want to comment on the issue of the risk, or otherwise, in releasing the source code for wide review. I do not think this is an issue because one would not be releasing the live code - the code that is used in a production sense. One would be giving copies of it for outside experts to examine and make recommendations for changes, which would come back into the system in a controlled way, so there are absolutely no security concerns in doing that. I accept that there are arguments one way or the other but in my view the arguments are much stronger in favour of releasing the code, as was done in the Australian example, which has been well documented. In that case, it was made available and even though experts had produced it, external experts found some errors that had been missed by the internal experts and they improved it. That could well be the case here. There are good arguments for taking that route and, properly managed, there is no security concern.