|
Unfortunately, the media continues to misconstrue much of the controversy over so-called paperless electronic voting
systems.
They often just don't understand the difference between having a completely paper ballot voting system (like the olden
days) and utilizing a mixed system wherein the paper ballot is available, and the electronic direct recording voting machines
contain a voter verified/verifiable paper audit trail.
The Brennan Center has released a new report, according to Fox 'n Friends July 3, 2006. the FNF programming included
guest with Voter Action who made an odd statement: we can't let our voting systems rely on trust. Somewhere there
will be someone who will attempt to fraud the system...
Say what? Where was the outrage when votes were manufactured using names of deceased, dogs and cats, you get the
picture. How about the lever machine voting systems? Who did we trust then? We couldn't see the back of
the machine? We couldn't determine whether ballots were cast fraudulently on those machines and nobody complained about
them for decades and decades of use and misuse.
What needs to happen? We need voter identification uniformly across this nation. clean up the voter registration
rolls of deadwood and have a monthly clean up. Have a uniform system of voter identification, not the mismash we have
now.
|
|
Issue: electronic, computerized voting and voter verified paper receipts and/or voter verified paper audit trail
Election Reform Stumbles on HAVA Hangups
Scientists question electronic voting
Monday, March 3, 2003
Across the country, computer scientists warned of the problems associated with touch-screen voting machines that did
not have a voter-verified paper trail.
Here's the problem:
Posted on Fri, Feb. 21, 2003
The clearest explanation I've heard of the security problem with touch screen systems
and the commonsense solution to it came from Alan Hu, an associate professor of computer science at the University of British
Columbia and a protege of Professor Dill. He offered it during a hearing this month. It's worth repeating.
Imagine a store, he said, where the clerk shows you the total of your purchases
on a handheld electronic calculator. Behind the counter, he enters your purchase amount into a ledger. He shows you the total,
then clears the calculator for the next customer.
Suppose the clerk occasionally pockets the cash and ``forgets'' to enter the purchase
in the ledger book. Or maybe he skims off cash and enters a smaller amount than what you purchased.
A computerized voting machine that shows your votes on a display screen only and
records your votes internally is like a clerk using a handheld calculator. To reduce the risk of cheating or help catch sloppy
errors, you can do a background check on the clerk, just as you can certify a voting machine's hardware and software. You
can have the clerk fill out duplicate ledgers, analogous to redundant hard drives in voting machines. You can encrypt the
ledger books to prevent others from forging them -- and encrypt data storage and transmission in voting machines. But in both
cases, no amount of security or auditing of records will catch cheating or errors, because the cheater is the one preparing
the audit record.
The solution to a dishonest clerk is simple. The clerk enters each transaction on a cash register, and the customer sees
what is on the cash register tape. If there's any doubt about the clerk's accuracy or honesty, you compare what the clerk
recorded with the cash register tape.
The solution for the voting machine is essentially the same: You show a printed copy of the ballot for the voter to confirm;
if there's a discrepancy, the voting machine can be shut down. If there's any doubt about the correctness of the voting machine,
you can compare the totals it reports with a separate count of the printed copies.
A man with many analogies, Hu compares a touch-screen system without an independent audit trail to a car with a subtle
flaw in the design of the gas tank that makes it capable of exploding. The car may be great in lots of ways, but, he says,
you want to be darn sure the gas tank gets fixed.
Paper Trails and Voting System Certification
Following is the link to the March 28 presentation
by Michael I. Shamos, Ph.D., J.D of Carnegie Mellon University
in Pittsburgh, Pennsylvania,
titled Paper Trails and Voting System Certification.
Dr. Shamos is a Distinguished Career Professor,
School of Computer Science,
Co-Director, Institute for eCommerce and Director, Universal Library. He is one of two consultants hired
by the Pennsylvania Department of State to conduct the state’s statutorily-required certification of election equipment.
Dr. Shamos runs the Master of Science in
eBusiness Technology program. His research interests are in digital libraries, electronic payment systems, electronic voting,
electronic negotiation, Internet law and policy, and experimental mathematics.
Note that the presentation is copyrighted
and any reference to it should credit Dr. Shamos.
http://euro.ecom.cmu.edu/talks/Paper20060328.ppt
While I don't condone the companies' refusal to do business with Leon County, it was poor judgment for Sancho to work
in conjunction with the Black Box voting folks in conducting a test. These are folks who have clearly demonstrated that they
have an agenda -- showing that voting technology is unsafe -- and are not above sensationalism in promoting this agenda. Thus,
it shouldn't come as a great surprise that voting machine vendors aren't too anxious to sell their wares to Leon. It would
have been more prudent to have had someone like Dr. Shamos conduct such a test, and the results obtained would've had much
more credibility. One other interesting voting technology item: The Georgia house voted to approve a study of "voter verified paper audit trail" (VVPAT) technology in three counties in November's general election.
While I've been skeptical about whether VVPAT technology will actually provide a workable and effective solution to the security
problems associated with electronic voting, if one really wants to determine whether this technology will function as intended,
this is the way to do it -- that is, by experimenting with it in a few counties and then evaluating the results, rather than
rushing to deploy technology that's not been successfully used anywhere throughout a state. Yet that's exactly what's
happening elsewhere ... and we can expect that there will be problems.
| Understanding the Debate Over Electronic Voting Machines
|
| Tova Andrea Wang, The Century Foundation, 5/26/2004 |
 |
Read the Issue Brief
Read the Press Release
|
| |
INTRODUCTION
Prodded by the federal legislation enacted to prevent the 2000 presidential election debacle from happening again, jurisdictions
across the country have been moving away from paper-based and mechanical methods of voting towards the use of so-called direct
recording electronic (DRE) devices, computerized voting machines that work much like bank automated teller machines. But in
the process of trying to solve problems associated with the old systems hanging chads and the like a whole new set of concerns
have arisen. What began as a campaign a couple of years ago by a small group of computer scientists who believe that DRE systems
are vulnerable to hacking and malfunction has become a national controversy. |
What are the advantages of electronic voting machines?
- Through features such as audio voting and hand-held voting devices for voters with limited physical dexterity, DREs can
be made fully accessible to the disabled, including the visually impaired. For many disabled voters, that means being able
to cast private, secret ballots for the first time.
- Computerized voting machines also have the capacity to provide ballots in an unlimited number of languages, benefiting
language minorities.
- The flexibility and design possibilities of DREs promise greater user-friendliness, which can translate into a lower rate
of ballots not counted due to error.
- Unlike with punch card and optical scan machines, DREs make it impossible to overvote inadvertently.
- Finally, a number of studies have shown that the votes of minorities are less likely to be counted when paper-based systems
are used, and that these disparities are greatly reduced when electronic forms of voting are employed.
Sources/More
Information:
Understanding the Debate over Electronic Voting Machines
Tova Andrea Wang (The Century Foundation) May 26, 2004
http://www.reformelections.org/feature.asp?menuid=%7B8DD3D739-A1A1-4E59-AA05-FCAF44A23A29%7D#5
UCP Submits Comments to US Election Assistance Commission on Computerized Voting (5/5/04)
Comments of the Rights Task Force of the
Consortium for Citizens with Disabilities on the
Use, Security
and Reliability of
Computerized Voting Systems
The Election Assistance Commission
May 5, 2004
Studies indicate a high degree of acceptance of DRE’s by voters, of all ages, abilities and ethnic and racial backgrounds,
who have used them. DRE’s, in fact, can reduce many of the operational problems in handling paper ballots that have
often led to election irregularities.
DRE’s store information in multiple formats and locations within the system’s program. In order to tamper with
an electronic voting machine an individual would first have to know the machine’s program and storage components, and
then would have to infiltrate those numerous components of the machine undetected. Procedures for securing the machines can
ensure the integrity of the voting system. If these procedures are implemented, there is no reason to believe that a well-run
election system based on DRE’s will not work properly. In fact, modern voting systems like DRE’s can be much better
than the punch card voting machines and lever machines that they are replacing.
The history of elections in this country has demonstrated that paper ballots can be easily tampered with or even lost.
Additionally, it cannot be assumed that just because a voter verifies their vote on a piece of paper, the machine is recording
the same result. If, in fact, a machine can be hacked into and reprogrammed to give a certain result, it can also be reprogrammed
to produce a paper record of one result, but record a different vote. The key to security is to maintain a well-designed election
protocol to ensure the integrity of every machine’s security.
http://www.ucp.org/ucp_generaldoc.cfm/1/8/12056/12056-12056/5502
Questions and Answers
How do different voting technologies affect specific population groups?
Studies have shown that areas which are low-income and have high minority populations are more likely to have higher numbers
of uncounted (spoiled) ballots than affluent, white areas. The Harvard Civil Rights Project found that of "the 100 counties
with the worst (highest) spoilage rates nationwide…67 of these have black populations above 12%. Of the top 100 counties
with the best performance (lowest spoilage), the reverse is true-only 10 had sizeable black populations, while the population
of 70 of the counties was over 75% white." Other research has traced this disparity to a higher incidence of punch
card and other voting systems that do not alert voters when they have overvoted, resulting in more spoiled ballots.
Sources/More Information:
African Americans, Voting Machines, and Spoiled Ballots
Tova Andrea Wang (The Century Foundation) September 15, 2004
Who Uses Inferior Voting Technology? 
Stephen Knack (University of Maryland) and Martha Kropf (University of Missouri, Kansas City) January 2001
What is a 'voter-verified paper trail' and how can it improve the security of electronic voting machines?
A voter-verified paper trail is a paper copy of a voter's choices produced by a DRE. The paper ballot would appear under
a glass screen attached to the electronic voting machine to be verified and then deposited in an internal box. Proponents
argue that by having a contemporaneous, independently cast, physical paper ballot, a manual recount is possible if the election
is challenged. In addition, voters can be sure that the vote they cast on the machine is the vote that is actually being recorded
and tabulated. Numerous bills have been introduced in Congress and state legislatures that would require voting machines to
produce a voter-verified paper-trail.
However, other experts and advocates are skeptical of the usefulness of paper trails. They have argued that printed ballots
could still susceptible to fraud and will add prohibitive costs and difficulties to systems which promise important benefits
to traditionally disenfranchised classes of voters.
Sources/More Information:
Voter-Verified Paper Record Legislation Page
(VerifiedVoting.org)
Voter-Verified Paper Audit Trail Legislation & Information
(Electionline.org)
Testimony on Voter Verification
Ted Selker (CalTech/MIT Voting Technology Project) June 2005
http://www.reformelections.org/feature.asp?menuid=%7B8DD3D739-A1A1-4E59-AA05-FCAF44A23A29%7D
The following is an excellent starting point concerning disputes among computer experts. Please read the entire
article.
Electronic Voting: Threatening or Enhancing Democracy?
Vivion Vinson is a freelance writer living in College Park, MD
...Dr. Rebecca Mercuri, a research fellow at Harvard's Kennedy School of Government and oft-cited expert witness on
electronic voting, has developed a model called the Mercuri Method for secure electronic voting with a paper ballot. "We don't
know how to prove that a computer program is correctly doing everything and not doing something we don't want it to do. There
is no mathematical way of proving that a program is 100% correct," she said in a recent interview.
For this reason, a paper ballot is, she claims, the one way (given current technology) that permits a voter to evaluate
whether his or her selection has been recorded correctly, and which also makes possible an independent audit to ensure the
validity of the election - should the vote be contested on suspicion of fraud or technological mishap.
However, Dr. Ted Selker, Associate Professor of Media Arts and Sciences of MIT, and member of the Cal Tech/MIT Voting
Project, disagrees strongly. He has developed his own method for paperless, secure electronic voting, and believes that presenting
the voter with two or more different formats - such as a display screen and a paper receipt - actually makes it harder and
more complicated for that voter to verify the results. "Have you ever tried to compare two columns of numbers?" he asked,
and then described some of the longer ballots he has seen with over a hundred entries.
When asked about the possibility of fraud, Dr. Selker responds with a number of points. There have been no documented
cases of fraud, he says, whereas there have been documented cases of millions of votes lost because of poor ballot design,
problems with registration, and polling place practices. This, he says, is where the focus needs to be in the immediate future
- while securing against fraud is simply a lower priority for the moment. "No matter what technology you give me, I can cut
failed votes in half by just changing the registration database implementation, ballot design, and polling place practices."
Nonetheless, he concedes that at some point in the future, securing electronic votes will become a more important issue.
With regard to the use of paper ballots for recounts and election audits, Dr. Mercuri and Dr. Selker differ again -
this time on the logistics of paper.
Says Dr. Mercuri: "I am not saying the paper ballot method is 100% correct; we have to rely on voters, people, equipment
- and we do have to have other layers of accountability. But we do know how to deal with paper - with ATMs, point-of-sale
terminals, etc. ...We have very good controls over paper."
Says Dr. Selker: "The problem I have with paper is that it can be torn, stolen, mangled, it's hard to read - even when
they do optical scan readers, they need to use the same reader [to recount] because they might be calibrated differently....
Physically moving paper around is difficult."
After wading through all of the technical detail - too much to include in this article - the argument comes down to
basic philosophies regarding what constitutes true and effective voter validation, and whether the addition of paper constitutes
a help or a hindrance in the event of an election dispute.
What both computer scientists seem to agree on, however, is that the current technology leaves something to be desired,
and neither sees her or his respective secure voting model - with or without paper - represented adequately by vendors...
http://www.afsc.org/pwork/0312/031214.htm
N.Y. Times and Avi Rubin on Electronic Voting
Today's
New York Times includes a story on electronic voting, focusing on the security concerns that some have expressed. The story quotes extensively from Avi Rubin,
co-author of a widely publicized report regarding asserting vulnerabilities in Diebold's system. On the other side, the Times
quotes election officials such as Bobby Kahn whose remarks I noted in a post earlier this week. My take: It's distressing that the Times continues to disregard the civil rights
implications of this debate. Instead, the debate is presented as being one between technologists on one side, and election
officials and vendors on the other. No mention is made of the accessibility advantages that Direct Record Electronic ("DRE")
systems have for people with disabilities, or of the vocal opposition that disability rights advocates have expressed to the
proposed contemporaneous paper replica ("CPR") that Rubin and others urge. The Times doesn't discuss the disability access
requirements of either HAVA or the ADA. See here. Finally, there's no discussion of the advantages that electronic voting machines have for citizens of color, in eliminating
the racial gap in uncounted vote that tends to exist with other systems. See the report of Tomz & Van Houweling and this post. Equally distressing is the continuing attention paid to the views of Rubin, who seems to have little if any understanding
of election administration. The report of Rubin and his colleagues entitled "Analysis of an Electronic Voting System" looked solely at Diebold's source code. He and his colleagues admittedly lacked an understanding of how this electronic voting
system is implemented, instead relying on certain "assumptions" that turned out to be incorrect. Among those incorrect assumptions
is that DRE's would be hooked up to a network or the internet (they aren't) and that voters might receive the "smart cards"
used to operate the machines in the mail (also false). The counterfactual assumptions upon which Rubin relies severly
diminish the value of his analysis. As stated in a report commissioned by the State of Maryland: "While many of the statements made by Mr. Rubin were technically correct, it is clear
that Mr. Rubin did not have a complete understanding of the State of Maryland's implementation of the AccuVote-TS voting system,
and the election process controls or environment." It goes on to explain that "most of Mr. Rubin's findings are not relevant
to the State of Maryland's implementation" of the Diebold system. Even Rebecca Mercuri, a prominent critic of DRE
security, has critiqued Rubin's report. Mercuri's critique notes that Rubin's assumptions are "inconsistent with existing elections and programming
practices" and rest largely on "conjecture." She also notes that some of Rubin's hypothetical fraud scenarios are equally
possible with paper based systems: "Although the scenario described is possible, it involves considerably more effort than
would be necessary to just collude with poll workers and create a few extra bogus voters at the end of the day using the legitimate
equipment. This is no different from adding ballots to a ballot box or ringing up a few extra votes on a lever machine when
nobody is looking." http://equalvote.blogspot.com/2004_02_01_equalvote_archive.html
...The combination of the lack of standards, legislative loopholes, trade secrecy, usability problems, privacy, security,
and other inherent computer issues results in a dangerous "trust-us" mentality. Transparency in the process is essential,
not only to provide auditability, but also to enhance voter confidence. This can be provided, quite simply, through the use
of a voter-verified physical audit trail for use in recounts.
A method of voting described by this author over a decade ago, referred to as the Mercuri Method, requires that the
voting system print a paper ballot containing the selections made on the computer [see illustration]. This ballot is then
examined for correctness by the voter through a glass or screen, and deposited mechanically into a ballot box, eliminating
the chance of accidental removal from the premises. If, for some reason, the paper does not match the intended choices on
the computer, a poll worker can be shown the problem, the ballot can be voided, and another opportunity to vote provided.
At the end of the election, electronic tallies produced by the machine can be used to provide preliminary results,
but official certification of the election must come from the paper records. Since the ballots are prepared by computer in
machine- and human-readable format, they can be optically scanned for a tally, or hand-tabulated for a recount. After the
election, yet other entities (such as the League of Women Voters or a news organization like Reuters) can verify the ballots
using their own scanning equipment, if the format is produced in a generic way.
This type of system is cost-effective. No longer must blank ballots be prepared in advance, as with mark-sense or
other paper-based voting systems. Incidentally, mark-sense products — pre-printed ballots with circles or ovals that
a voter fills in with a pencil or pen — do provide a physical record that is available for recount. They have the lowest
undervote rate of all the computerized tabulation systems, according to a number of studies, including one by the Caltech/MIT Voting Technology Project [see On the Road Toward Electronic Voting ].
One e-voting system, still only at a trial stage, from Populex Systems (West Dundee, Ill.), is similar to the Mercuri
Method. As company founder Sanford Morganstein puts it, "The count is not something that's kept in a computer, but one that
is tangible, that you can look at." Nonetheless, it differs in an important respect: voters use a touch screen to generate
a printed ballot that contains only a bar code to indicate the votes. Thus, the system is open to vote tampering, according
to Doug Jones, a computer science professor at the University of Iowa who examines e-voting technologies, since many voters
won't check that the bar code matches their choice.
According to Jones, an election could be rigged by altering at random, say, one ballot in 100, enough to swing many close
elections. "If only 1 voter in 100 bothers to check, that means that only 1 in 10 000 will find an error," Jones says. And
who's to know that the bar-code reader hasn't been programmed to misread ballots? Hence, the Mercuri Method requires a human-readable
plain text printout.
Besides its utility in recounts, the fact that the voter sees the final ballot on the screen as well as on paper has been
shown to help voters catch their own mistakes. Visually impaired or illiterate voters can be allowed to use voice-feedback
scanners to read the paper ballot, so they would not be disenfranchised by this process.
The Mercuri Method recount concept has been incorporated into recent voting legislation reforms (including some in Florida,
California, and Maryland) that require the voting systems to produce paper audit trails. Brazil will use the method for 3
percent of its voting systems in an upcoming election.
Although some vendors, such as Avante Systems (Princeton, N.J.), have started to incorporate voter-verifiability into
their products, the largest companies have oddly interpreted these laws to mean that audit trail printing can be done from
the internally recorded ballots after the election. Their claim is that cryptography and redundancy will be used to secure
the data. But these techniques are insufficient to ensure end-to-end correctness, since voters cannot verify that the ballots
produced are indeed the ones they cast. Furthermore, data can be corrupted (intentionally or accidentally) early in the process,
resulting in stored information that seems correct, but may not be.
Cryptography can, though, be effectively used along with a voter-verifiable ballot to prevent ballot-box stuffing, and
to make certain that the paper tallies match the electronic results. David Chaum, a Palo Alto, Calif., cryptologist who, 20 years ago, invented electronic cash, has a technique that provides the best
of all possible worlds: a computer-generated, voter-verified physical ballot that also gives the voter a receipt that can
be used to determine that his or her vote was tabulated correctly, without revealing its contents.
One drawback of Chaum's method is that to demonstrate that the votes are tallied correctly requires a lot of math. As
a result, it is difficult to explain to election officials, poll workers, and voters how it establishes the correctness of
the balloting and tabulation process. But it gives a glimpse of the type of voter-verifiable systems that may be used for
future elections.
An observer of voting technology once remarked: "If you think technology can solve our voting problems, then you don't
understand the problems and you don't understand the technology." Computerization alone cannot improve elections. Those designing
and those buying election systems must be aware of their inherent limitations, mindful of the sometimes conflicting needs
for privacy, auditability, and security in the election process, and willing to seek out-of-the-(ballot)-box solutions.
More
... With paper ballots, the trail is a recount of the ballots. With
electronic machines, it's a printout of the results.
For
skeptics, that's the electronic system's biggest weakness.
"Any programmer can write code that displays one thing on
a screen,
records something else, and prints yet another result. There is no
known way to ensure that this is not happening
inside of a voting
system," argues Rebecca Mercuri on her Web site:
http://mainline.brynmawr.edu/~rmercuri/html/
Mercuri
is no Luddite. She's an assistant professor of computer
science at Pennsylvania's Bryn Mawr College.
But she has
been a vocal critic of electronic voting for about 10
years - in fact, her doctoral dissertation was titled "Electronic
Vote
Tabulation Checks & Balances."
One of her first assignments for incoming Bryn Mawr freshmen is to
design a computerized
voting system that displays one vote count and
records another.
It is disturbingly easy, she said.
The audit
trail is not the only problem Mercuri has with electronic
voting. But having such a trail would address many of the
technological
and cryptographic problems that concern her and others.
"The voter has to get some sort of paper that comes out at
the time
that they vote, and they look at it and say, 'Yup, that's the way
that I voted,' '' said Mercuri.
Mercuri advises counties not to buy voting devices immediately. She
expects Congress to establish federal standards
for voting machines
as part of the election reform they are considering. The National
Institute of Standards and Technology
might be enlisted to certify
the machines, she said.
Bederson believes electronic voting machine manufacturers should
improve
usability of their products first and foremost.
A properly audited electronic system could offer benefits mechanical
systems
don't have, Mercuri acknowledged. A paper ballot could be
optically scanned, saving election workers the time it takes
to
recount every one. Voters could even get a cryptographic card to
verify that their vote was entered into the system,
although it would
not tell them how they voted.
Envisioning an electronic system with a voter-verified paper audit
trail,
Mercuri allows herself a moment of enthusiasm.
"It's no worse (than the punch-card system), but it can be made to be
extraordinarily
better."
More...
(The following is undated material and does not seem to be reviewing voter verified paper audit trail (paper being the
key word)
|
Frequently Asked Questions about DRE Voting Systems |
|
David L. Dill, Rebecca Mercuri, Peter G. Neumann, and Dan S. Wallach
|
 |
|
|
|
|
|
|
|
|
|
