This Sunday’s New York Times Magazine has an article by Clive Thompson on electronic voting machines. Freedom to Tinker‘s Ed Felten is briefly quoted, as are a small handful of other experts. The article is a reasonable summary of where we are today, with paperless electronic voting systems on a downswing and optical scan paper ballots gaining in popularity. The article even conveys the importance of open source and the broader importance of transparency, i.e., convincing the loser that he or she legitimately lost the election.
A few points in the article are worth clarifying. For starters, Pennsylvania is cited as the “next Florida” – a swing state using paperless electronic voting systems whose electoral votes could well be decisive toward the 2008 presidential election. In other words, Pennsylvania has the perfect recipe to cause electoral chaos this November. Pennsylvania presently bans paper-trail attachments to voting systems. While it’s not necessarily too late to reverse this decision, Pennsylvania’s examiner for electronic voting systems, Michael Shamos, has often (and rightly) criticized these continuous paper-tape systems for their ability to compromise voters’ anonymity. Furthermore, the article cites evidence from Ohio where a claimed 20 percent of these things jammed, presumably without voters noticing and complaining. This is also consistent with a recent PhD thesis by Sarah Everett, where she used a homemade electronic voting system that would insert deliberate errors into the summary screen. About two thirds of her test subjects never noticed the errors and, amazingly enough, gave the system extremely high subjective marks. If voters don’t notice errors on a summary screen, then it’s reasonable to suppose that voters would be similarly unlikely to notice errors on a printout.
Rather than adding a bad paper-tape printer, the article explains that hand-marked optical tabulated ballots are presently seen as the best available voting technology. For technologies presently on the market and certified for use, this is definitely the case. A variety of assistive devices exist to help voters with low-vision, zero-vision, and other issues, although there’s plenty of room for improvement on that score.
Unfortunately, optical scanners, themselves, have their own security problems. For example, the Hart InterCivic eScan (a precinct-based optical scanner) has an Ethernet port on the back, and you can pretty much just jack in and send it arbitrary commands that can extract or rewrite the firmware and/or recorded votes. This year’s studies from California and Ohio found a variety of related issues. [I was part of the source code review team for the California study of Hart InterCivic.] The only short-term solution to compensate for these design flaws is to manually audit the results. This is probably the biggest issue glossed over in the article: when you have an electronic tabulation system, you must also have a non-electronic auditing procedure to verify the correctness of the electronic tabulation. This is best done by randomly sampling the ballots by hand and statistically comparing them to the official totals. In tight races, you sample more ballots to increase your confidence. Rep. Rush Holt’s bill, which has yet to come up for a vote, would require this nationwide, but it’s something that any state or county could and should institute on its own.
Lastly, the article has a fair amount of discussion of the Sarasota fiasco in November 2006, where roughly one in seven votes that were cast electronically were recorded as “undervotes” in the Congressional race, while far fewer undervotes were recorded in other races on the same ballot. If you do any sort of statistical projection to replace even a fraction of those undervotes with the observed ratios of cast votes, then the Congressional race would have had a different winner. [I worked as an expert for the Jennings campaign in the Sarasota case. David Dill and I wrote a detailed report on the Sarasota undervote issue. It is our opinion that there is not presently any definitive explanation for the causes of Sarasota’s undervote rate and a lot of analysis still needs to be performed.]
There are three theories raised in the article to explain Sarasota’s undervote anomaly: deliberate abstention (voters deliberately choosing to leave the race blank), human factors (voters being confused by the layout of the page), and malfunctioning machines. The article offers no support for the abstention theory beyond the assertions of Kathy Dent, the Sarasota County election supervisor, and ES&S, Sarasota’s equipment vendor (neither of whom have ever offered any support for these assertions). Dan Rather Reports covered many of the issues that could lead to machine malfunction, including poor quality control in manufacturing. To support the human factors theory, the article only refers to “early results from a separate test by an MIT professor”, but the professor in question, Ted Selker, has never published these results. The only details I’ve ever been able to find about his experiments is this quote from a Sarasota Herald-Tribune article:
On Tuesday [November 14, 2006], Selker set up a computer with a dummy version of the Sarasota ballot at the Boston Museum of Science to test the extent of the ballot design problems.
Twenty people cast fake ballots and two people missed the District 13 race. But the experiment was hastily designed and had too few participants to draw any conclusion, Selker said.
Needless to say, that’s not enough experimental evidence to support a usefully quantitative conclusion. The article also quotes Michael Shamos with some very specific numbers:
It’s difficult to say how often votes have genuinely gone astray. Michael Shamos, a computer scientist at Carnegie Mellon University who has examined voting-machine systems for more than 25 years, estimates that about 10 percent of the touch-screen machines “fail” in each election. “In general, those failures result in the loss of zero or one vote,” he told me. “But they’re very disturbing to the public.”
I would love to know where he got those numbers, since many real elections, such as the Sarasota election, seem to have yielded far larger problem rates.
For the record, it’s worth pointing out that Jennings has never conceded the election. Instead, after Florida’s courts decided to deny her motions for expert discovery (i.e., she asked the court to let her experts have a closer look at the voting machines and the court said “no”), Jennings has instead moved her complaint to the Committee on House Administration. Technically, Congress is responsible for seating its own members and can overturn a local election result. The committee has asked the Governmental Accountability Office to investigate further. They’re still working on it. Meanwhile, Jennings is preparing to run again in 2008.
In summary, the NYT Magazine article did a reasonable job of conveying the high points of the electronic voting controversy. There will be no surprises for anybody who follows the issue closely, and there are a only few places where the article conveys “facts” that are “truthy” without necessarily being true. If you want to get somebody up to speed on the electronic voting issue, this article makes a fine starting place.
[Irony sidebar: in the same election where Jennings lost due to the undervote anomaly, a voter initiative appeared on the ballot that would require the county to replace its touchscreen voting systems with paper ballots. That initiative passed.]
More news about high-tech vs. low-tech voting:
http://news.yahoo.com/s/ap/20080121/ap_on_el_pr/overseas_voting
@Mike Critelli: “I have never heard a good argument against voting by mail, with the possible exception of the argument that there is no control over coercion and undue influence…”
Which, as it happens, is the number one argument against vote by mail. Vote by mail makes it quite easy for somebody to observe you or “help” you as you vote. Or for that matter, they could just purchase your unvoted ballot from you. It’s hard to ever find hard evidence of voting fraud, but I’ve heard anecdotes of absentee ballots being resold, in bulk, with their origin being places like nursing homes.
The ability to vote again (of which may absentee voters may be unaware or unable to avail themselves of, particularly when it’s close to the deadline) is perhaps the only way for an absentee voter to address the threat of coercion or bribery. It’s unclear whether this works in practice, despite its possibly working in theory.
It’s easy to imagine various mildly cryptographic extensions to vote-by-mail. Consider having a four-digit PIN on the outer envelope. The PIN represents a shared secret between the voter and the election administration. Get as many ballots as you want, cast or sell as many as you want, but only ballots with the proper PIN on them are ever taken from the outer envelope and counted toward the election. Still, this raises some tricky questions. How many voters out there would be unable to remember such a PIN, or would be forced to reuse a PIN from elsewhere in their life? This sort of thing damages the usability of vote-by-mail and would increase the spoiled ballot rate.
To the extent that I can reach any conclusion, it’s that there’s no silver bullet for voting systems. Once you recognize that voters are people, and not machines, with all the limitations inherent in people (limited memory, limited time, limited ability to follow instructions, etc.), the problem of creating an ideal voting system becomes much more difficult than you might otherwise think.
P.S. With respect to increasing voter turnout, there’s one tried-and-sure approach that’s used outside the U.S. to completely solve the problem. Election Day is a national holiday, and voting is compulsory. This is how Australia and Brazil do it, among other countries. If you fail to vote, a variety of penalties can come into play. Now, an intriguing question is whether it’s good or bad for a democracy when people who don’t actually *want* to vote are compelled to do it anyway.
As I have pointed out in my Blog (http://www.mikecritelli.com), the most secure solution for voting, as well as the easiest to use, is actually a modern-day version of the paper ballot, secure voting by mail. With technology now available, the ballot can be secure and trackable from origin to destination and back again to the elections officials. Name and address matches can be verified, and the election officials can validate that a single person is receiving and responding to a single ballot, and that the ballot recipient and voter are the same person, through a combination of a machine-based signature match and a supplemental human validation.
Moreover, voting by mail avoids a lot of other headaches:
– No machine breakdowns;
– No problems with audit trails;
– No provisional ballots; and
– No need to have people wait in long lines on a single day.
I also believe that, to the degree that we can, we should be supplementing the paper ballot with a description of the candidates and the other items being voted upon. California does this, and it translates the ballot and the explanatory material into multiple languages.
I have never heard a good argument against voting by mail, with the possible exception of the argument that there is no control over coercion and undue influence at the moment a voter is casting his or her ballot. That problem is easily addressed, by allowing the voter to change his or her decision prior to election day, which is what Florida does today.
As far as the argument that voters should evidence their commitment by appearing in person, I do not find that persuasive. It fails to take into account real-life emergencies that voters have, whether those emergencies relate to problems voters have as caregivers, as employees or business owners, or as travelers to a polling place. We need to make voting more convenient, not less.
We particularly need to find a way to engage more young people in the voting process.
I think the optical scanners are probably the best solution, but to take it one small step further, you could have a computer which presents the ballot to the voter. Each voter would vote ‘electronically’ and at the end the machine spits out a paper ballot which has been printed with that voter’s choices. The voter can personally inspect the markings to be sure there are no mistakes. The voter places the ballot into the ballot box where it is counted by an optical scanner after the polls close. The counting machine should have no other task than to read in a ballot and tally the votes.
This way you have 3 ways to verify the results: 1. the paper ballot (which should be regarded as “the vote”), 2. the numbers recorded in the tallying machine, and 3. the records of the voting machine.
This should allleviate the problems of voter anonymity since the ballots are fed into a sealed box before they are counted, so there’s no real way to know which ballot belongs to which voter, even if there are only a few ballots cast in a given precinct. Also, to Davey’s point, if necessary because of extremely high turnout, voters could be able to mark the ballots themselves in lieu of using the machines.
Using a computer and printer to record the votes will reduce (if not eliminate) voters failing to fully mark the ballot for a candidate which could lead to a fiascy similar to the ‘hanging chad’ debacle of 2000. But the key is giving voters a paper ballot that they can personally inspect before placing that ballot into a sealed box to be counted. If they aren’t satisfied with their ballot, they should watch it be shredded and then be allowed to re-vote on the machine or take a paper ballot and mark it themselves.
New technology has a wonderful potential to assist us in creating faster, simpler elections. We must be careful to use this technology to assist voters in expressing their intent, rather than trying to express that intent for them.
Optical scan ballots seem like the best approach to me, though I would like to see a spot where voters would mark the number of races in which no candidate had been selected and/or a “NO CANDIDATE SELECTED” spot for each race. If a voter inserts a ballot in which there are more unmarked races than the number indicated, the ballot would be rejected for correction. If there are fewer unmarked races than the number indicated, the ballot would be rejected for replacement.
If the machine is designed to reject any ballot which does not pass the validation check, then there is no “excuse” for spoiled ballots in the ballot stream. A voter’s decision to abstain in a race cannot be changed by a dishonest poll worker without spoiling the ballot, and the appearance of a spoiled ballot in the vote stream should raise suspicion.
Of course, given that elections are often handled without any effort to keep an accurate count of the total number of ballots (allowing the appearance of ‘magical mystery ballots’ weeks after the election), the quality of machines is probably pretty far down on the list of problems.
How can I correct typo errors?Rosemarie Myerson
The most impoortant fact as you point out is the need for a manually done audit on randomly selected optical scanner machines and that it be done immediately after the vote tally has been printed from the machie before the ballots are moved or whatever. My son, a Nobel prize winner, has long said that without a deterrent, when the winning stakes are high and you can not get caught, you will cheat if possible. Clearly optical scanners are more easily corrupted than touchscreens; you only need to alter one tenth the number of machines. But with the paper ballots, you have a wy of exposing any fraud or “errors” in tallying. By doing the audit immediately after the vote tallies are printed you have a good chance to expose the “errors” and also to find out how it happened. This is the deterrent we need to election fraud.
i sent this information to NYTimes and maybe it will be printed.
The really brain-dead part of this whole issue is that we’ve abandoned a cheap, reliable, auditable and functioning voting system in favor of a technology that offers none of these things — chiefly because one side was unhappy about the outcome of a close election.
There clearly is no better technology than the punched card. We should throw out all the high-tech solutions and go back to this simple, reliable system.
Sure, we should be more careful how we design our ballots — but moving away from punched cards is worse than throwing the baby out with the bath water. More like the whole orphanage….
I agree with Barry. I would make more sense to require a “I choose not to cast a vote in this race or on this issue” option so that the voter’s intention isn’t left hanging. It wouldn’t prevent tampering, but at least the voting could be reconciled.
The other issue which I think is often ignored in comparing touchscreens to optical-scan systems is scalability.
A touchscreen system means a hard limit to the number of people who can simultaneously cast votes in a polling place. If turnout is higher than anticipated then lines will be long and slow and there is no workaround. (And of course an unscrupulous election administrator could misallocate touchscreens to slow voting in selected precincts.)
The optical-scan machine requires only about a second to process a ballot. Voters only use the machine after their ballots have been completed, and a dozen additional simultaneous voters can be accomodated for the cost of a box of appropriate pens.
Having been an election observer in an optical-scan precinct, I cannot think of a single reason why a touchscreen system would be preferred for the vast majority of voters. (The one exception being the ability to accomodate disabled voters.)
PEBTAC
Problem Exists Between Touchscreen And Curtain
Personally, I believe electronic voting machines are good for only one thing — stealing elections in a way that the common voter will never be able to understand.
What will it take to get people to give up on these machines? I’m hoping that “Alfred E. Neumann” will be elected in a landslide arranged by hackers. This would be much more effective than any number of “expert” reports.
John: There are a wide variety of theories related to hardware failure of the ES&S iVotronic systems that were used in Sarasota. The FSU study only looked at the software. The state’s study was similarly limited in what it considered. The Jennings campaign and their experts (including myself) were never allowed anywhere near the machines or their source code. At this point, all we can say for certain is that we don’t know which of the issues you identify may or may not have contributed to the undervote rate. Perhaps the GAO investigation will learn something new.
As to next time, keep your attention focused on parts of the country still using paperless DRE systems. If and when something goes wrong in a close election in one of these places, we can only hope that expert reviewers get the necessary access and resources to figure out what happened. Here’s a thought experiment. What happens if we have a repeat of Sarasota, with a tight margin of victory and a significant number of “lost” votes that we can provably determine were irretrievably lost? What then? Do-over? Statistical projection of the likely winner?
The Audit and your study never considered the PEB’s as the problem, ADA machines in Sarasota did not register a serial number for the PEB used to collect votes some 7000 voters plus. Review US Patent # 5,583,329 fpr a look inside the workings of this device. The firmware for the T Screen controler was never investigated, again you should have considered it, mostly driving the Burquest mfg screens. The FSU Audit never looked at like machines as Sarasota had, they were different versions of the orgional 2001 mfg machines. Ballot definition came from the PEB’s and during the recount there was no accounting for the actual ones used in the recount and in the general election. Did you consider that there were massive power failures (196,000$ ) of replacment batteries just prior to the election and the obsolate 386SX main processors fail to be correct at 4.9 V according to Intel.. mixed PEB’s were used in the polling stations so no one was matched with a machine and they were sealed by the supplier with no way to test the with out dismantling them for malware. Next time insist on a full evaluation HDW/Software/ on actual machines under sever voting loading.
I’ve never understood why electronic voting machines don’t just display one question per screen and ask for confirmation if you don’t choose any of the options. Do the ballot creation tools provide this option to the elections officials, or does the machine automatically cram everything it can onto one screen?
Also, the problems with some voting machines eating their own paper trail is one of the reasons why the statutory requirement in some states to treat the paper trail as gospel truth bothers me. If correctly designed, the electronically stored vote is far less prone to error than the paper trail – the problem is that nobody has correctly designed an electronic voting system and put it into production yet.