A Design for a Genuinely Verifiable Evoting System


By Richard C. Hawkins

Professor Emeritus, UCLA

Telephone:  310-444-9882




The system described below coincides with the recommendations of the symposium on electronic voting held at the Kennedy School of Government at Harvard in June of 2004.


It uses a voter-marked ballot card as final authority.


However, it, and any other truly verifiable system that may be introduced later may be precluded from sale by the deadlines imposed by HAVA, unless those deadlines are extended.



Because of your interest in verification for electronic voting systems, we would like to inform you of a system which we have recently submitted for patent. Working with electronics experts, we are now producing and programming a small number of prototypes.                                                                                                                        


Our system begins and ends with the voter’s actual vote, rather than attempting to verify a computer generated representation at the end of the ballot. The design is called the ActualVote System. It is based on the old Votomatic platform and ballot card, in order to take advantage of the long experience that both voters and poll workers have had with that system, and to simplify the problems of training for making a transition.


This design also presents a possibility that the Votomatic systems that are currently in use might be converted by adding the electronic component, if that approach should seem desirable.


In order to vote, the voter uses an electronic probe, instead of a stylus, to mark the ballot card with ink. The voter-marked ballot cards, which can be counted by optical scanner, or by hand, are kept as the only authoritative record of the voters’ intentions. They are the only evidence that is to be used for counting, or recounting any challenged race. They can also be used to verify the results of the electronic count, either of a single machine or of an entire election.  


The voter is guided by a ballot and instructions shown on a computer screen, and also by voice heard through earphones. Using the probe, the voter touches an open voting point to identify a candidate, or proposition, and then, if satisfied, presses down to mark the ballot. The vote is transmitted instantaneously to the electronic section and verified for the voter, both on the screen and by voice, in the voter’s chosen language.


When the ballot is completed, a list of the votes is shown on the screen and is also heard repeatedly by voice for the voter’s final confirmation. Although it would seem superfluous, an optional printer can be provided to print out the results.


We believe that the system can do anything useful that any other electronic voting system can do. In addition to offering multiple languages, both written and spoken, the system blocks overvotes and does not allow unintentional undervotes. If voters register the intention to undervote on a race, a record is kept of those undervotes. Although it is not easy to make a mistake in using this system, in case of error, provision is made for canceling previous votes and obtaining a new ballot.


The system is specifically designed to eliminate the many problems and dangers that have been revealed in the existing e-voting systems. As we see it, their chief danger comes from the lack of any means of easy, dependable verification. This problem underlies and magnifies all of their other deficiencies.



In order to insulate against possible fraud, the individual voting machines are never linked together, and are locked against any outside access before being sent to the precincts.  Any intrusion, whether official or otherwise, is recorded as to time and date. Votes are recorded and counted on each individual machine, and can be tabulated either at the precinct level or at voting headquarters. The ballot cards are kept for accurate recount. They can also be used as a check on the accuracy of individual machines, or of the total vote. 


Our system is also designed to eliminate a new and dangerous element that has been introduced into our voting process - the manufacturers’ representatives. Because of the secret and proprietary codes by which their machines are governed, only the manufacturers and their employees have sufficient knowledge to service them, and may be needed to participate in every phase of the process, from preparing the machines for an election, to dealing with electronic problems and repair in the voting precincts. This provides numerous opportunities for politically motivated manufacturers to influence an election’s outcome. Their representatives’ presence has been noted in many questionable situations.


The system is designed to be as open and transparent as possible. It is programmed entirely in open source Linux, which will be available for inspection by any designated authority.


To eliminate the opportunities for interference, our system includes a program that makes it possible for non-technical employees to prepare the machines for an election. Furthermore, it does not require numbers of computer experts to maintain or repair the equipment. Any malfunctioning machine can be repaired by simply removing a faulty board and plugging in a new one.  This does not require any great skill. Taken together, these provisions remove any excuse for manufacturers to take part in the election process.


In order to register a vote, the probe is guided to mark the ballot card accurately with fast drying ink. This eliminates the possibility of random marks and smudges which could cause a miscount.


Because voters do not touch the screen, errors caused by inaccurate touches or by faulty screen calibration are eliminated.


The difficulties commonly encountered by blind or otherwise handicapped voters have been carefully considered. It should be possible for blind voters, listening to the voice prompts, to vote normally and to use any of the machines, marking their ballots beside normally sighted voters. The standard models should meet the needs of all but the most severely handicapped persons.. For those who cannot manipulate the probe, we can offer the ability to cast and verify their votes by voice, with a paper printout taking the place of the ballot cards.


The system provides for “straight ticket” voting, and can also be set up to accommodate the increasingly attractive “ranked choice” and “cumulative” voting systems.

A system of voting by numbers, guided by voice or screen, makes it unnecessary to print new ballot pages for each election. This can result in large cost savings. However, fully printed ballot pages can be used, if desired.


Because of the use of ink-marked ballot cards, this system could make it possible to complete an election, even in the unlikely event of total electrical and battery failure.


A long-life battery is included. There is also the ability to connect to an automobile cigarette lighter, in order to allow for curbside voting.


Another convenience is a light that signals when a voting station is not in use.  


The lower initial cost of the system, the elimination of printing costs by the system of voting by numbers, the ease of programming for elections, the possible elimination of run-off elections, and the reduced cost of repair and maintenance could amount to large savings for any voting venue. The most important benefit of truly verifiable machines, however, would be to restore confidence in the reliability of the American voting system. 


As we have indicated, we are working with electronic experts to assemble, program, and  test the first few prototypes. We expect to be able to show these by midsummer. When we are ready, we will be looking for U.S. companies who have sufficient experience, resources and interest to manufacture and market the system.


Unfortunately, we are very late in this effort, and cannot possibly meet the HAVA deadlines set for 2006. The current vendors lobbied heavily for those deadlines with two obvious objectives: to force the rapid sale of their dangerous machines, and to forestall the introduction of more satisfactory systems.


The HAVA deadlines conspire with the current manufacturers to mandate that local jurisdictions purchase unverifiable and easily corruptible equipment.  The localities will be forced to do so in order to obey the law and to take advantage of government funding. These deadlines will not only legislate a criminal loss of taxpayers money; they will also lock our nation’s elections into a system that promises to be much worse than the one that it was intended to replace. Allowing this to happen can only amount to aiding and abetting a national fraud.


We urge that every effort be made to have the deadlines extended, not only to avoid the great waste of public money, but also to make it possible that we, or some other manufacturer, can have time to introduce a safe, honest and verifiable system.


We would welcome any comment or suggestion.

Richard C. Hawkins

Professor Emeritus, UCLA

Telephone:  310-444-9882