search

DemocracyDevelopers / colorado-rla

Colorado Risk-Limiting Audit (RLA) software – developed to support risk-limiting post-election audits of election outcomes.
Other
0 stars 0 forks source link

Think about and add tests for discrepancies involving contests not on the CVR #145

Open vteague opened 2 months ago

vteague commented 2 months ago

Two issues raised by @michelleblom , relating to plurality auditing.

  1. when the system computes potential discrepancies for plurality audits it does not take into account the case where the CVR has a vote for a contest on it that is not on its matching paper ballot (or the CVR does'nt have a vote for a contest that is on the matching paper ballot). This would be the case where the CVRContestInfo for a contest is null in one of the CVR/auditedCVR data structures but not both. I'm thinking of a potential manipulation where contests are added to/removed from the CVR. I'm not sure whether colorado-rla already checks for this somewhere. Each ComparisonAudit has a list of CVR IDs that should contain the contest on it, and I think this is determined based on the ballot manifest. So, it would actually be easy to do a check somewhere that this manipulation hasn't happened. I wrote the discrepancy computation for assertions that checks for this case (to be on the safe side). Although I'm not sure if it's even possible for the system to get into a state where such a CVR/ACVR pair is passed to the discrepancy computation methods. However, if it is possible, then currently for plurality audits no discrepancy would be found in that case.
  2. I'm also not convinced by the isCovering() check that is done in the recordDiscrepancy() method of ComparisonAudit. Which, by the way, is not present in the removeDiscrepancy() method or computeDiscrepancy() method. What it does is if a discrepancy has been computed for a CVR/audited ballot pair, it will not be recorded in a ComparisonAudit's discrepancy counts if the CVR is not meant to have the contest on it. I'm not going to include that check in IRVComparisonAudit unless it's clear there is some reason for it.