Note: Where available, the PDF/Word icon below is provided to view the complete and fully formatted document
Joint Standing Committee on Electoral Matters
16/11/2016
Conduct of the 2016 federal election and matters related thereto

BRIGHTWELL, Mr Ian William, Private capacity

WEN, Dr Roland, Private capacity

[13:57]

CHAIR: Good afternoon, gentlemen, and thank you very much for appearing here today. Although the committee does not require you to give evidence under oath, I should advise you that this hearing is a legal proceeding of the parliament and therefore has the same standing as proceedings of the respective houses. The giving of false or misleading evidence is a serious matter and may be regarded as a contempt of parliament. The evidence given today will be recorded by Hansard and attracts parliamentary privilege. I now invite you both to make opening statements before we proceed to questions and discussion with the committee.

Mr Brightwell : I would like to thank the committee for the opportunity to present at this hearing. I appear before the committee in a private capacity and have no commercial interest in the matters I have raised in the submission. My testimony today is informed by my experience with the New South Wales Electoral Commission between 1999 and April this year. During most of that period I was the New South Wales Electoral Commission's Chief Information Officer and developed most of the commission's systems, including the internet voting system iVote, which I managed for both the 2011 and 2015 state elections and the intervening by-elections. I also worked as a polling place manager and pre-poll manager for the AEC at the last election.

Electronic voting has rightly been considered by the committee to be a significant issue—one which needs careful consideration before implementation. Previous reports of this committee have justifiably cautioned against its implementation without a clear understanding of the benefits and justifiable risks. It may therefore come as a surprise to the committee that the AEC has in fact implemented a form of electronic voting for the Senate, which has all the associated risks of an electronic voting system but has no reviewable verification process or transparent audit controls.

Prominent security researchers and academics from the University of New South Wales, Melbourne University and the Australian National University have all expressed concern about the level of audit controls currently applied to the new Senate preference capture system. This group believes that at the very least the new Senate system output should be audited against a sample of input ballots. Currently AEC have advised they are not doing this because it is not required under legislation.

At this point, I would like to declare my position on the use of electronic voting. I advocate that a limited use of electronic voting should be adopted by the Australian Electoral Commission. However, it should only be implemented where it assists enfranchisement of disadvantaged electors or improves the return of results. I also believe the adoption of electronic voting is necessary in the medium term to address the inevitable demise of postal voting and help maintain participation levels for younger voters. I also believe that in-district attendance voting should continue to be offered in a paper based form and, most importantly, be scrutinised in a polling place on election night, and that includes Senate papers.

Notwithstanding my support for the use of electronic voting, I do have some concerns about its adoption without the implementation of suitable controls. The current paper process controls use a scrutineer to observe the counting process, who raises issues with the returning officer when anomalies are identified in a ballot or over the tally process. This control does not work for the scanning centre process, as the scrutineer is unable to identify if their observations of ballot papers are supported by the final tallying, which is often published some weeks later. Put simply, the average scrutineer does not have the necessary skills or time to perform the requisite audit task to determine if the computer system being used is operating in the intended manner and the output results are reasonable compared to the observations.

One of the authors of our submission was appointed a scrutineer for a party contesting the New South Wales Senate election. He attended the count centre and asked the AEC staff at the centre questions which would be normal for an audit. He was told that, because the act did not require the AEC to provide such information, they would not be responding. The AEC further advised, on their website, that independent testing had been done on the system. The scrutineer asked if he could review a copy of the tests. Again, he was refused those documents, on the grounds again that the act did not require the AEC to provide the documents. I subsequently requested, under FOI, the same documents, and at this stage they have not been provided.

It is the view of the authors of this submission that the AEC currently is not living up to the standard it has outlined in its service plan, which is:

The AEC is committed to delivering processes that uphold electoral integrity and engender voter and stakeholder trust in the result …

Also, significant discrepancies were found between the number of House of Representatives votes counted and the number of Senate papers counted. This is almost certainly innocent human error by election officials who are being asked to do a highly repetitive task over long periods. They are not able to do repetitive tasks in that way.

The proposition we are putting to the committee is that the Electoral Act needs to be changed. We are proposing that not only should end-to-end verification of votes be done but more information about testing and operation of the system should be made available to scrutineers at each event. We are also proposing that a new type of scrutineer be created that has the skills to scrutinise the new electronic voting systems the AEC have implemented. We, however, acknowledge that the conduct of these scrutineers needs to be controlled for good electoral governance—that is, the findings of these scrutineers should only be reported to the commission during the election and reported publicly post-election.

Notwithstanding my critical comments above regarding the transparency of the Senate count, I would like to compliment the commission on implementing a viable system in such a short time. I would also like to compliment the previous committee on supporting the necessary change to the Senate count process, which greatly improved the stability of the Senate count.

In addition to my joint submission, I have also made a personal submission, which addresses the following issues: roll divergence and its potential increase in New South Wales; proposing a national approach to system redevelopment for the AEC systems; addressing and assessing working hours at polling places; reducing polling place and prepoll issuing errors by 100,000 nationally, through the use of roll look-up devices; improving integrity of 100,000 electors' votes nationally, who potentially could have voted in the wrong state or division; 50,000 votes nationally for people who are currently not enrolled, through the use of enrolment votes; increasing the number of votes counted on election night, by introducing electronic voting, in the same manner that Antony Green recommended; using paper docket verification in prepolls, which also has the advantage of improving the integrity of the prepoll counts; and reducing queues through the increase of ordinary issuing staff in polling places.

I would also be pleased to answer any questions on proportional representation should you wish to ask them. Thank you for your patience. I would now like Dr Wen make his opening remarks.

Dr Wen : I will add some remarks on election technology more broadly. Election technology has become a core part of elections, not just in Australia but internationally as well. Many issues arise because the use of technology fundamentally changes the electoral process. This applies to both more visible systems like e-voting and also behind-the-scenes systems, like the new Senate vote capture system. There are two key categories of issues that I will cover. The first is transparency, scrutiny and trust. The second is building election systems as failure-critical national infrastructure.

The first category of issues is transparency, scrutiny and trust. Our current electoral practices and legislation are designed for manual processes and these revolve around observing human actions and physical artefacts. When electronic systems perform some of these actions and there are virtual artefacts, then simply observing the process is no longer effective. What is needed are new approaches to providing transparency, scrutiny and trust that are designed specifically for electronic systems. For instance, part of this involves providing transparency of the design, implementation, testing and auditing of electronic systems so that they can be scrutinised and another part involves building in features to the systems and processes that make problems, failures and malicious activity more transparent for scrutiny. For instance, in the case of the Senate vote capture system, adding a cross-check of final electronic vote data against the paper ballots would help to make failures evident to scrutineers. Addressing these issues is a substantial challenge. It requires ongoing thought and planning to update electoral practices and legislation in line with technological changes so that elections can remain rigorously scrutinised and well trusted.

The second category of issues is building election systems as failure-critical national infrastructure. In the Australian Electoral Commission's submission they pointed out that their current IT systems are at the end of their useful life and need to be refreshed. This is an excellent opportunity to rethink how election systems should be built. The current systems are commercial grade, developed by commercial vendors and operated in a commercial environment. In this commercial approach, inappropriate compromises and shortcuts happen all the time due to resourcing and time pressures. The consequences can be catastrophic, as we saw with the ABS census failures. For elections, the technology needs to be built using failure-critical engineering practices to manage the risks and to provide strong assurance of reliability, quality and security. The challenge is to work out how to build election systems as failure-critical grade. It is a difficult problem because the expertise in the IT industry at large is in building commercial systems, but failure-critical engineering needs a broad range of highly specialised expertise. Also, it seems impractical to expect a single electoral commission to have all the expertise needed. A possible approach to consider is a partnership between, say, electoral commissions across Australia along with the Department of Defence and a range of experts in failure-critical systems. What is essential is to start discussing the best way forward so that an appropriate approach is established before new election systems are built.

Those are the two key categories of issues with election technology. I welcome any questions.

CHAIR: Thank you very much, Mr Brightwell and Dr Wen. I can safely say on behalf of the committee that we are very grateful for your very considered verbal submissions and also your written submissions, particularly in relation to the two major issues you just discussed, Dr Wen. The committee has already come to the conclusion that we need to unpack all of these issues further and have some more robust debate in the new year on how we get this system right moving forward into the 21st century. We will certainly ask you questions now, but I am certain that we will invite you back in the new year to take part in further discussions with us as we go to the detail of the particular issues. Thank you very much for your presentation.

Mr GILES: Thank you, Mr Brightwell and Dr Wen. I should echo the chair's comments that your evidence both in submission and today has been very instructive. There is just one issue that I would like to explore now, and hopefully we will have other opportunities. In the submission provided in your two recommendations you touch at some length upon an audit of the new Senate counting process and you make the observation that you were effectively advised that the sought of audit that you would recommend was not permissible under the current legislation. There are two questions that arise from me. Firstly, can you give some further particulars on the basis upon which that advice has been given. Secondly, it occurs to me that what you are really saying, Dr Wen, is that I am asking the wrong question, and what we really need to do is to think through how votes are being cast now and, in light of that, look holus-bolus again at how we satisfy ourselves that elections are being conducted properly. Is it fair?

Mr Brightwell : If you like, I will answer the first bit about the response from the AEC and then Dr Wen might like to answer the second bit about system engineering. If you looked in one of our submissions—I cannot quite remember which one—we actually had snippets out of the emails. I am happy to find you the email exchange. Doug Orr, who I know well and who I have a lot of respect for—we had an email exchange; or, should I say, the scrutineer did. Basically, we asked for three documents. He came back and said, 'Not under the act.' If you like, I will give you those emails. That would be the easiest way.

The commentary in terms of being at the scrutiny centre and the scrutineer asking questions, the scrutineer has actually provided a written response. I could ask them if they were happy to have that released to the committee as well. They were provided as just notes to myself, but it was very clear that they were not going to get provided any of the information that would be normally asked by an auditor reviewing a system of this nature. It just was not going to happen.

Mr GILES: I could identify some of the practical considerations but I just could not quite understand the legislation prohibitions.

Mr Brightwell : I am happy to give you the document trail, if that helps the understanding. We were a bit surprised because we always thought the scrutineers would be given privilege and information, and we were a bit surprised when it did not happen.

CHAIR: Is there anything else?

Mr GILES: I think Mr Wen has answered my leading second question. I thank him for his contribution, which has really been useful to me.

Senator RHIANNON: I also feel like I have a great deal to process here. I have a couple of questions which are obviously pretty superficial at this stage, but which will help my understanding. As I listened to you, and in reading your document, I must admit I was feeling uneasy about how it is all working. At any stage did you feel that the last election was compromised or that there were was a potential that it could have been compromised?

Mr Brightwell : Again, I will have a go first, and Mr Wen might like to also assist me. Contrary to most public opinion of how elections work, we have a view that they are not deterministic; they are not black and white. I think Senator Macdonald reflected in one of the early hearings that he watched people counting votes and, on the third or fourth go at counting the same votes, they still got different answers. The fact is there is error in these processes when you put humans in it. So they are actually probabilistic.

What you are asking me is: what is the probability that the wrong people got elected? I would say extremely low. The only exception I would say to that is possibly with the last senator in Tasmania because 141 votes, I think, was the difference. It is so close in 250,000-odd. You could toss a coin on that. I do not believe anyone could put their hand on their heart and say they absolutely guarantee that outcome. When you get to a couple of thousand, as with New South Wales, I think you are in safer territory. So, probabilistically, you are okay. And I have sliced the numbers in New South Wales. But, again, if you look at one of my responses in terms of the mismatch between the House of Representatives and the Senate, until those issues are declared by the AEC to be not material—that is to say that that thousand votes that were in that pile and not in that pile were just a human error—you would have to wonder where they are. That is, I think, the real question. There are a lot of reconciliation errors that at this point we are just assuming are okay.

Senator IAN MACDONALD: Are you talking Senate or Reps or both?

Mr Brightwell : The point is you do not know. When you are comparing House of Reps to Senate, I can show you in my response—

Senator IAN MACDONALD: I really meant your comment that the result could change.

Mr Brightwell : I take your point. I was particularly talking about Senate. But, in the case of House of Reps, and when you look at Herbert, again, toss a coin. I have worked in and managed a polling place in prepoll and I have worked 15 years in elections, and when you are down to those sorts of numbers toss a coin. It is that—

CHAIR: I do not think you need to toss a coin, Mr Brightwell, in the rerun of the WA Senate by-election. I think that is the perfect example of your case. That was all the chair's editorial there.

Senator RHIANNON: Dr Wen, did you want to add to that?

Dr Wen : No. I think Ian answered that really well. When the election is close, that is when there is a really high risk of something going wrong. We want to have a really high assurance of the quality and security of the system, so that when the election is close we can still be confident of the outcome.

Senator RHIANNON: Absolutely. The AEC said that they were not in a position to release this information. You also touched on that. You are probably also aware that there have been some requests for them to release the source ware, and they also have not done that, and that is being taken up in parliament as well. Do you see that what is critical here is that there just needs to be much greater transparency and that all this needs to be in the public domain so people like you can work on it and people like us can try to understand it? Is what we are talking about that we just need to have greater openness?

Mr Brightwell : Again, I will have a go and Roland can have a go. We probably differ a little bit on that. I, personally, think open source is nice, but there is a lot you can do before you go to open source. The trouble with big complex systems—and it is a little hard to explain to people who are not familiar with how they are built—is that just saying 'open source software' is not realistic. These systems are built of many bits and pieces. The build instructions are enormously complex. The whole exercise of making it open source could be, as Anthony Green said earlier today, a huge burden on the electoral authority because anyone could come along and ask questions which you have to use high-value resources to answer or interrogate.

The real issue, at this stage, if you want to look at the priority order of events, is to try and get transparency in the operation of the system so that you can have confidence that the actual results are correct on a given election event—and that is what that checking of a sample is about—and also to ensure that the testing and operation has been as per the plan. If we can achieve that and have maybe semi-open source ware, the code could be reviewed by people with the right skills and qualifications. That would be a good outcome. I think making it open source where anyone in the public can go along and say, 'What is that line of code about?' is a risk to the government at large at this point in terms of wasting a lot of resources.

Dr Wen : I understand it is a difficult issue. Ian does raise a really good point. Personally, I am in favour of greater openness, of course. But, yes, it has to also be balanced with the fact that it cannot waste too many resources of the Electoral Commission, so we do need to think about how we go about it.

Senator RHIANNON: What it means.

Dr Wen : For example, in the case of the Senate counting software that the AEC was not able to publish, that was due to conflicts of interest due to commercial interests overriding the public interest. That is a sort of problem that we really need to address. That is one of the serious issues that is blocking transparency at the moment.

Senator RHIANNON: My third question was going to be precisely about that. If we are bringing private companies in to do this, and their job is to make profits—they might be sold onto somebody else; who knows?—how can that possibly work when you are dealing with the integrity of the electoral system? Is that something that should we, as a committee, be considering? Is this something where the AEC needs to bring in that expertise within their own body, rather than pulling something off the shelf of a private company or just getting the private company to run it?

Mr Brightwell : I will have a go again and Roland can jump in. I think there are a few issues around that. One is the issue around the intellectual property of the code and whether it can be made open source. In fact, the code we are talking about it owned by the AEC. They will not make it open source substantively because they are making money out of it. In fact, I think that is an issue that needs to be cleaned up. I cannot see any reason dedicated election code which is for counting of votes should not be open source and available for that part of the process. You are right in saying a lot of the other systems—if you look at my last submission I had a nice diagram at the end that showed the collage of systems that the average election authority uses. There is an enormous amount of code and software in there which a lot of proprietary vendors are providing, but they are not handling votes; they are handling results. They are used for communication and they are used for publication. No-one particularly wants to inspect that code. It is not mission critical to the election process. There are certain core bits of code for proportional representation counting that should be made available to the public. There are certain bits of code within the actual internals of the electronic voting systems that probably should be made available, but it has to be done with a whole information piece around where they sit.

Dr Wen : I think we do need to re-evaluate our approach to procuring these systems and what role vendors have—whether we are just buying their products or if they are just providing services instead and the electoral commission has ownership of the software and is able to publish it if it decides to.

Mr Brightwell : Can I just have a go on that as well? In New South Wales, when we set up iVote one of the things that we considered was that we had to use vendors because we just did not have the confidence of skill internally and never would have. However, what we did was use multiple vendors. None of those vendors had access to or control of the votes; that was always the commissioner and myself. So at the end of the day you can set up these systems so that vendors are involved but they are involved in only doing the piece you say they do. For instance, Scytl managed the core voting system. They only managed one system out of three or four that were critical to the running of iVote, and they had no access to or control of any of the votes or of the management of that process. They only got in to do things when we let them in, and we managed and monitored what they did. It is a tricky process. Just managing the passwords so that you are achieving the outcome you want in transparency and control is in itself a tricky process.

Senator IAN MACDONALD: Thanks very much for your joint submission, and also for your latter submission, Mr Brightwell. I must say, for what it is worth, I agree with your recommendations—those that I fully understand, that is, which is not all of them. But that is on me, not you. The possible double voting issue concerns me. As you rightly say, in Herbert 48 were so serious to the AEC that they referred them to the AFP. I have no idea what that was all about. Would anything you have suggested give us the assurance that there is no possibility of me voting twice using someone else's name?

Mr Brightwell : I think Anthony Green this morning to some extent answered your question. I thought it was spot on. The record in New South Wales, incidentally, at the last state election was 15 votes from the single elector marked off at Port Macquarie. But when you peel back all the errors you only had a limited number of these. Those could be removed by electronic mark off in polling places. But, as you pointed out, that has to go back to the mother ship and those devices have to be connected. Every commission in Australia wants electronic mark off. It is a case of centralising the management of that and getting the economics right. Interestingly, the AEC is the key to that. So I would say that there is no doubt you could get rid of a large slab—certainly, nearly all the errors we were talking about. Anthony was, I think, incorrect in suggesting this morning that 180,000-odd multi-marks would be resulting in dec votes. What would happen is most of those would be sorted out in front of the elector. So only a very small portion of that would come from provisional votes and declaration envelopes.

Senator IAN MACDONALD: Every time I book into a motel these days I have got to prove to the receptionist that I am who I am; I have to give them my driver's licence. Do you have any view on why it is that apparently the only things you do in Australia where you do not need to prove who you are is register to vote and get a ballot paper?

Mr Brightwell : As I said, I ran a pre-poll and a polling place for these at the last election and I have run many polling places. I can tell you that about 10 per cent of the people walk up and, unsolicited, drop their driver's licence in front of you. My personal view is I do not want to see it compulsory. There is a provision in the act, at least in the New South Wales act at the moment, which says that you can, under certain circumstances, ask for identification. I think that could be broadened a bit because it gets very awkward sometimes for election officials.

Senator IAN MACDONALD: What is to stop me going into a polling booth in the electorate that you are in and saying, 'G'day, I am Ian Brightwell and I live at this address'—because I found that out—and them saying, 'Okay we will cross you off'? Fortunately, you have not been there before. If I get in at five past eight it is pretty certain you will not have been there and I can get your ballot paper.

Mr Brightwell : You know the answer to that question as well as I do.

Senator IAN MACDONALD: Were you with the AEC for some time?

Mr Brightwell : No, I was the CIO at the New South Wales Electoral Commission for 11 years and consulting to them previously. I worked for the AEC as a polling place manager and as a pre-poll manager, temporary officer.

Senator IAN MACDONALD: My question relates to either, is not really direct evidence and I do not want you to go into specifics. Are you aware in your long experience with electoral matters of any staff of either commission having a particular and active view on political parties and politics at any given time? I will not ask which side of politics.

Mr Brightwell : All the permanent staff are very aware of that. I have never seen anyone who is a permanent member of any commission actively express any views. It is sort of a no-no; you just do not talk about politics in that context. In fact you talk about both sides of politics equally flattering terms.

Senator IAN MACDONALD: I know you are lying now.

Mr Brightwell : As evidence was given earlier, the temporary staff is enormous. Nearly every election there are people who are asked if they would like possibly do another job rather than in a polling place or leave because they have been spotted as being strongly affiliated to one party or the other and that happens all the time.

Senator IAN MACDONALD: Can I specify that a bit more. The CPSU—up my way anyhow—was a very active campaigner in the election in Herbert even to the extent of being noticeably there on the pre-polls—and quite aggressively, I might say. If you ever come across any influence from the CPSU or other unions that might involve that sort of stuff—and again I am not asking you to be particular—

Mr Brightwell : I worked in North Sydney. They are very civilised in North Sydney. They all got on like a house on fire. All the how-to-vote hander outers and party workers were a happy little bunch, so I am not your man to ask about that.

CHAIR: On that happy note, is that your last question, Senator Macdonald?

Senator IAN MACDONALD: Yes.

CHAIR: Mr Brightwell and Mr Wen, thank you very much for appearing here today. As you can see, there are a lot of issues that we will no doubt be pursuing with you further as we inquire into the issues that you raised in the course of next year. Did you take any questions on notice?

Mr Brightwell : No.

CHAIR: We will be getting you back. You will be sent you will be sent a copy of the transcript of your evidence and will have the opportunity to request corrections to transcription errors. Thank you very much again for your time today.