Voting machines I recommend

I’ve written several articles critical of specific voting machines, and you might wonder, are there any voting machines I like?

For in-person voting (whether on election day or in early vote centers), I recommend Precinct-Count Optical Scan (PCOS) voting machines, with a ballot-marking device (BMD) available for those voters unable to mark a ballot by hand².  For vote centers that must handle a wide variety of ballot styles (covering many different election districts), it may be appropriate to use ballot-on-demand printers to produce ballots for voters to fill in with a pen.

Five different U.S. companies make acceptable PCOS and BMD equipment:

I do not recommend all-in-one voting machines that combine ballot marking and ballot tabulation in the same paper path, such as the ES&S ExpressVote (in all-in-one mode) or the Dominion ICE.

For mail-in¹ ballots, I recommend Central Count Optical Scan (CCOS) voting machines with ballot-serial-number imprinters.

All five companies listed above make CCOS equipment, and at least three of these companies make CCOS with serial-number imprinters:  ClearBallot, ES&S and Dominion.  CCOS printers from Hart (and perhaps Unisyn) do not imprint serial numbers; they can still be used in ballot-level comparison audits⁵ but less efficiently.

I make these recommendations mainly on the basis of security: let’s have election results we can trust, even though the computers can be hacked.  But PCOS or CCOS voting is also less expensive to equip than touchscreen voting.

Now I will explain the basis for these recommendations.

For in-person voting:  Paperless Direct-Recording Electronic (DRE) “touchscreen” machines are unacceptable because, if they are hacked to cheat, there’s no way to recover the true result of the election, and no reliable way to even detect the cheating.  DRE “touchscreen” machines with a behind-glass VVPAT (voter-verified paper audit trail) are not recommended because most voters don’t verify that the paper has a true recording of what they selected on the touchscreen, and it’s even more difficult to verify when the ballot is behind glass.  I recommend that voters should mark optical-scan ballots with a pen, not use a touchscreen BMD, because if the BMD were to be hacked to cheat, most voters wouldn’t notice.  Voters unable to mark ballots with a pen can use a BMD,  but they may also choose to vote by mail with assistance from someone they trust, if such a person is available³.  I don’t recommend all-in-one voting machines with ballot-marking in the same paper path with ballot tabulation for two reasons: first, the same problem as with any BMD, if the machine cheats then most voters won’t notice; and second, (if hacked) they can mark more votes on the ballot after the last time the voter has seen the paper.

For small-precinct election-day voting:  Election authorities should preprint optical scan “fill-in-the-oval” ballots enough to stock the precinct with enough ballots even for unexpectedly high turnout.  Yes, this will mean recycling a lot of unvoted ballots at the end of the day if turnout is not unexpectedly high.  You might think, “let’s use ballot-on-demand printers to avoid wasting paper.”  The problem is that they require maintenance:  replacement toner cartridges, backup machines if they fail entirely; and the polling places are staffed with hired-for-the-day pollworkers who cannot be expected to do this maintenance.

For vote centers with many different ballot styles:  In order to avoid stocking a vote center with many different piles of preprinted ballots, a ballot-on-demand printer may be appropriate.  Unlike election-day polling places, vote centers can be staffed with professionals who can replace toner cartridges and do other minor maintenance, and can be equipped with a spare machine in case the main ballot-printer breaks down.

By federal law (HAVA, 2002) every polling place must have an accessible voting technology that can be used by a disabled voter who cannot mark ballots by hand with a pen.  To accommodate these voters it is appropriate to equip every polling place with a ballot-marking device (BMD), basically a touchscreen plus audio-sensory interface that can be used by blind voters or (via an input control switch⁴ interface) those with motor disabilities.

A PCOS machine can handle two or three voters per minute, easily accommodating over 1000 voters in a day.  In contrast, a touchscreen (DRE, BMD, or all-in-one) can handle only one voter every two or three minutes.  Furthermore, for small-precinct election-day voting, if all voters are using touchscreens then each precinct will need at least two touchscreens in case one breaks down; but several precincts colocated in the same polling place can share a single PCOS (and if it breaks down, voters can still continue casting their ballots).   This means that up to four times as many touchscreens are needed as PCOS machines, a significant cost difference.  (In states where a single election might have as many as 50, 100, or more contests to vote on, all these numbers need to be adjusted: the PCOS machine might handle one or two voters per minute, and the DRE/BMD might handle only one voter every 5 or 10 minutes, but the ratio may be similar.)

Therefore, when PCOS machines are used, each polling place will need one PCOS machine and one BMD for use by disabled voters.  Depending on the manufacturer and on the contract that a state or county is able to negotiate, this costs $10,000 to $14,000 per polling place.

The Dominion ImageCast Precinct ICP320, first sold in about 2009, has an interesting feature that can lower a county’s cost very substantially:  it has a built-in audio BMD for use by disabled voters, so therefore one does not need to purchase a separate BMD.   The ICP320’s BMD is not in the same paper path as the scanner, so it does not suffer from the insecurity of an “all-in-one” machine.  I like this idea, and I’ll discuss this machine in another article at a later date.

For mail-in¹ ballots, one uses a Central Count Optical Scanner, which differs from a PCOS in that can count a much higher volume of ballots per minute.  For efficient risk-limiting audits (RLA) of paper ballots, it’s important that the CCOS machine produces an electronic file of cast-vote records (CVR) such that each individual CVR can be connected to a specific physical paper ballot; this permits a ballot-level comparison audit.  The only way (I know of) to do that is to print a serial number on each ballot.  The serial number must not be printed on the ballot before the voter casts the ballot, otherwise the secret ballot would be compromised (if the voter could record the serial number, then the voter could be bribed or coerced to vote a certain way, and would have proof of how he or she voted).  Therefore, the solution is to have the CCOS imprint a serial number on to the ballot while scanning it.  It’s important that the serial-number printer be physically incapable of printing votes onto the ballot; this is accomplished by having a tiny dot-matrix printer that can print only on the leftmost 1 centimeter of the paper.

Certain of the central-count optical scanners sold by Dominion, ES&S, and ClearBallot are available with this serial-number imprinter.

Unfortunately, nobody knows of a good way to equip PCOS voting machines with a serial-number printer in such a way as to preserve the secret ballot and enable efficient ballot-level comparison audits.  I’ll discuss this in another article at a later date.

Footnotes:

¹ “Mail-in” ballots: In some states, voters can fill out their ballots at home, then have the choice of putting their ballots in U.S. mail or dropping them off at a secure vote-deposit box maintained by election administrators.   Thus, it is a slight overgeneralization to refer to these vote-at-home paper ballots as “mail-in.”

² BMDs for voters unable to mark a ballot by hand: Some advocates for voters with disabilities strongly prefer that all voters use the same equipment, that is, all-in-one voting machines, so that the votes of disabled voters are not segregated.  This is an understandable preference.  Unfortunately, no known technology permits this in a way that adequately secures the votes of most voters, who cannot be relied upon to check that a paper ballot marked by BMD accurately reflects what they chose on a touchscreen.  In balancing the legitimate desire for mainstreaming of disabled voters with the legitimate desire for trustworthy election outcomes, until someone finds a way to do both at once, I recommend the latter.

³ States should make vote-by-mail accessible to all disabled voters in addition to accessible in-person voting technology.  Although return of marked ballots should never be done through the internet or by e-mail, it is quite reasonable to use the internet to deliver unmarked ballots to disabled voters, so that they can use the technology of their own choice (including their own computers) to mark the ballot before mailing it in or bringing it to a drop-off center.

⁴ A voter with a disability may use an input control switch suited for their particular needs.  An example is a “sip-and-puff” device, but sip-and-puff systems are used by only about one percent of switch input control users.

⁵ Central Count Optical Scanners that do not tie CVRs to serial-numbered sheets of paper, such as CCOS machines from Hart, can still be used in ballot-level comparison audits, but it requires finding exactly the nth ballot in a  batch.  This can be made to work if the batches are kept very small, such as 25 ballots per batch.