2016 election: AEC failed to account for all ballot papers

The Australian Electoral Commission was not transparent about the level of risk it accepted in its IT systems for the 2016 election, the audit office has found.

A report from the Australian National Audit Office has found that although the AEC could rule out any large-scale vote tampering, it did not conduct a statistically valid audit to demonstrate the data integrity of the election and could not account for all the ballot papers.

In March 2016 significant changes to electoral law introduced above-the-line preferences, prompting a decision to adopt a Senate vote-scanning system before the 2 July double dissolution election.

Asked to assess the AEC’s performance, the audit office found it had “not demonstrably achieved value for money” in its transport and ICT supply contracts.

To improve integrity a “late decision” was made for all voter preferences to be entered by a human operator in addition to being scanned.

“The AEC does not know the number or nature of mismatches to determine if this was a cost-effective risk treatment,” the report said. The decision added between $6.6m and $8.6m to the cost.

Due to time constraints the AEC waived the requirement on its ICT supplier to comply with government IT security frameworks including that it “must protect all AEC data when it is at rest”.

“The level of IT security risk accepted by the AEC on behalf of the Australian government, and the extent of the non-compliance with the Australian government IT security frameworks, was not transparent,” the report said.

“The wording used in some of the internal records and published materials would generate confidence in the security of the system whereas the underlying assessments indicated significant risk.”

The report concluded the AEC relied on its risk strategies to ensure the integrity of ballot paper data but had “not undertaken a statistically valid audit to verify or demonstrate data integrity”.

“The AEC accepted IT security risk above its usual tolerance. Insufficient attention was paid to ensuring the AEC could identify whether the system had been compromised.”

The audit office said the AEC was “unaware that any ballot papers were not accounted for” but warned this was “a considerably lower level of assurance than its stated performance indicator of accounting for 100% of ballot papers”.

The AEC set a tolerance for ballot paper discrepancies, such as a difference of 0.5% for Senate and House of Representative ballot papers at a polling place.

The ANAO noted a “high number of discrepancies in the AEC’s final data”. It could not demonstrate that discrepancies outside the tolerance were systematically identified and resolved.

With a total contract value of $8.7m for transporting ballot papers and $27.2m for the Senate scanning system, the audit office concluded the AEC had not given due consideration to cost.

“Insufficient emphasis was given by the AEC to open and effective competition in its procurement processes as a means of demonstrably achieving value for money.”

In response, the AEC said the Senate voting changes “were the most significant reforms to Australia’s electoral system in 30 years” and the 2016 election was “in many ways, [the] most complex in the nation’s history”.

“In the extraordinarily short period of three months, and without prior warning, the AEC successfully developed and then implemented a robust, effective, technologically advanced” counting system for 15m Senate votes, it said.

The AEC said it was confident the measures put in place for the 2016 election ensured the integrity of the Senate count.

“The AEC is committed to work towards achieving a high level of compliance with the Australian government’s security framework.

“Where extremely short immutable timeframes mean that full compliance with all aspects of the framework are not achievable ... the AEC will take a risk-based approach to identify, manage and accept/reject risks as appropriate.”

The AEC said after the 2016 election it revised its procurement approach to logistics and would “deliver increased value for money”.