Wisconsin clerk's explanation - MAJOR RED FLAGS

markpkessinger

(1000+ posts) Send PM | Profile | Ignore

Fri Apr-08-11 07:12 AM
Original message

Wisconsin clerk's explanation - MAJOR RED FLAGS

Edited on Fri Apr-08-11 07:23 AM by markpkessinger

I am an IT specialist for a large law firm with a number of years' experience in designing and coding Access and SQL Server databases, as well as in evaluating data security for highly sensitive data. When I heard the clerk's explanation, in her press conference, of how the votes were supposedly imported but not "saved," my antennae immediately went up.

First, Access has a built-in autosave feature, whereby if a user imports data into a table from an external source (such as an Excel spreadsheet, which the clerk claims she imported from), or even if the user is manually entering data into an existing table, and then simply closes the database, Access automatically saves the data, and does not prompt the user to "save." A user is prompted to "save" when a completely new database object (such as a table, query, VBA module or report) is created, or when the design of an existing object is altered. If the cursor moves to a new record, the record the cursor was previously on is automatically saved. If a table or even the whole database is abruptly closed, the data is still automatically saved. If you import data and then your computer suddenly crashes, requiring a restart, or the power goes off, the imported data will still be there.

Now, if one is a fairly sophisticated Access user with some experience in writing underlying VBA code, one could conceivably create a macro or VBA procedure that would perform data validation requiring the user to then hit a "save" button (and discarding the data if the button were not clicked), but I didn't get the impression, based on the kinds of terminology she used to describe what may have happened, that the clerk has anywhere near that level of coding expertise. In fact, she claimed that she "may have turned the macros off"; but if she did that, then the database would have defaulted back to native Access functionality, which would mean the autosave feature would again be active.

Second, the clerk claims to have put all the data onto a personal computer in her office to which only she has the password. She said she did this in order to provide greater security of the data. But data security, especially when dealing with data as sensitive as votes, involves more than merely guarding against inappropriate or unauthorized access. It also entails making sure that at least one other person -- someone who is independent of the primary user -- can gain access in the event an unforeseen event (such as the sudden incapacitation or death of the primary user) should arise. From the standpoint of data security, it is just as important to ensure that all appropriate parties have the access they may need under any circumstance that can reasonably be anticipated as it is to protect the data from unauthorized access. Also, a database storing data a sensitive as votes would be expected to implement complete record-level change tracking, such that for each ballot record in the database, a complete history could be retrieved, for each ballot, of the dates and times the record was modified and the user who performed the modification -- in other words, an audit trail. But if data validity and security are of paramount importance -- and in this case they certainly are -- then the last thing you want is for data to be accessible by one individual with no ability to independently monitor that individual's activities within the database.

Finally, and this is related to my second point above, Access and Excel are in any case wholly inappropriate containers in which to store sensitive voting data, owing to the fact that their "back ends" are fairly easily accessed and tampered with, and their lack of native user-level activity tracking and record-level change tracking. (That functionality can be created, but again, it would require someone with a pretty advanced knowledge of VBA coding.)

The technical inconsistencies, taken together with the fact that the clerk just "happened" to find almost the exact number of votes not only to hand the election to Prosser, but to insulate him against the threat of an automatic recount, and the rather troubled history this clerk seems to have had in the past concerning matters of data security, says to me that this entire incident is suspicious enough to warrant a very thorough investigation.