http://www.eff.org/e-vote/e-vote_white_paper_20040517.pdf

Accessibility and Auditability in Electronic Voting

EFF White Paper, May 17, 2004

Background

Nearly one-third of American voters – over 50 million people – live in districts that will use electronic voting terminals to elect the next president.1 However, widespread reports of voting terminal failures,2 and growing concern about the security3 of these machines, are fueling fierce debate over how to ensure the integrity of our elections. An important part of this discussion has focused on whether and when to equip direct recording electronic (DRE) voting terminals with a voter-verifiable paper audit trail (VVPAT).4 The nation’s leading security experts5 and a growing popular movement champion the VVPAT, although it is by no means the only possible solution.

As a result, America is rethinking electronic voting. Seven states now have directives or laws requiring VVPAT, and 14 others have introduced similar legislation.6 Federal legislators are considering reforms that would mandate a VVPAT for DREs.7 In some election jurisdictions, officials have deferred multi-million dollar DRE purchases8 while others are upgrading to non-DRE voting systems.

A False Choice

The prospect of complications or delay in DRE deployment has alarmed some members of the disability rights community.9 That alarm has been fueled by two myths: 1) that VVPAT-enabled DREs do not exist and 2) that only DREs can provide accessible voting to people with disabilities. For example, the American Association for People with Disabilities’ (AAPD) website states, “Touch screen voting systems that provide a [VVPAT] do not exist, have not been tested in the real world, and are not certified.”10 Further, a recent lawsuit filed on behalf of AAPD and others claims that “only DRE systems, when properly equipped, are accessible and enable voters who are disabled to vote independently, unassisted and in secret.”11 If taken at face value, these statements imply that the push toward verifiable elections must pull us away from accessible elections.

We reject this false choice. Accessible, auditable, federally qualified machines are available for purchase today, and more are scheduled for release in the coming months. Non-DRE methods of accessible voting are both available and in development. Even jurisdictions that have already purchased paperless DREs can take additional steps to increase the integrity of their elections before the November 2004 election.

Options for Auditable and Accessible Voting

The Help America Vote Act (HAVA) rightly required every polling place to have at least one accessible voting machine by January 1, 2006. We support this timetable, and, where possible, we encourage election jurisdictions to provide accessible, auditable voting machines before that date.

Accessible Alternatives to DREs

The controversy over DREs has also distracted the public from the availability of other accessible, auditable voting technologies. Optical scan systems are the most widely used voting technology in the country, and they can be made accessible with both high- and low-tech solutions.

Tactile ballot templates12 for optical scan ballots can be used, in conjunction with an audio interface, to aid the blind and non-English speakers in casting ballots without assistance and in secret. This technology is used throughout Rhode Island, costs very little, does not require voters to know Braille, and has been endorsed by AAPD’s Jim Dickson, one of the accessible voting community’s most outspoken advocates.13

Electronic ballot markers can be used to fill out optical scan ballots. These systems look like traditional DREs, but they record votes on paper ballots instead of internal memory. This kind of machine can match all of a DRE’s accessibility features (audio interface, sip/puff input, multiple languages, etc.), and every vote can be verified before submission:

a.

Avante’s14 Optical Vote-Trakker15 is a federally qualified, accessible, electronic ballot-marking system. It was the first system qualified to the FEC’s 2002 voting standards, a designation that means, in part, that it produces a 0% error rate even after 1.5 million votes. Certification is pending in several states.

b.

ES&S, 16 the world’s largest election equipment manufacturer, is also in the process of attaining federal qualification for an electronic ballot marking system. It will be available later this year.17

DREs with Voter-Verified Paper Audit Trails

DREs equipped with a VVPAT can also provide auditable, accessible voting:

a.

Avante’s Vote-Trakker18 is an accessible, VVPAT-equipped DRE that has completed federal testing. It is certified for use in several states and has certifications pending in others.19 This system has been used successfully in five separate elections and the American Council of the Blind lists the Vote-Trakker as an accessible voting system.20 In addition, Jim Dickson of AAPD has called Avante’s VVPAT an “elegant way” to provide a paper audit trail if one is mandated.21

b.

AccuPoll22 produces a federally qualified, accessible, VVPAT-equipped DRE system.23 The company is actively pursuing state contracts and expects to have equipment in the field for the November 2004 election. The American Council for the Blind lists AccuPoll as an accessible voting system manufacturer.24

c.

Sequoia Voting Systems,25 the country’s third-largest election equipment manufacturer, will have a VVPAT-equipped AVC Edge26 on the market by the summer of 2004. The unit will be deployed in every Nevada election jurisdiction in time for the 2004 presidential election.27

d.

TruVote is in the process of qualifying a VVPAT-equipped DRE. The system also allows voters to verify that their vote was part of the final vote tally via a post-election web interface. The TruVote system should be qualified and available for purchase in the summer of 2004.

Adopting These Solutions

Unfortunately, the existence of accessible, auditable equipment does not guarantee that it will be considered for purchase. Certification hurdles and election official education must be addressed in jurisdictions planning to purchase machines before the November election.

a.

Certification hurdles - The U.S. has a patchwork of different certification requirements, and sometimes these requirements are all that stands between a federally certified voting machine and a market. Where possible, we hope that states will expedite their certification processes to allow the procurement of auditable, accessible machines. This is especially important in states where counties are still trying to purchase new systems before the November election.

b.

Election Official Education - Some election officials have inadequate market knowledge and are therefore unable to make informed decisions about voting machines. For example, Colorado Secretary of State Donetta Davidson recently claimed, “To date, there has not been a single voter-verifiable voting system tested or certified at either a national or state level.”28 Neither part of this statement is true for Colorado, but it nevertheless precludes Colorado from making an informed procurement choice. All of those concerned about elections, whether focused on accessibility or security, should address these kinds of misconceptions.

Jurisdictions that Already Have DREs

Some counties have already purchased paperless DREs, and replacing those machines with one of the systems described above before the November election may be impossible. In those cases, DREs could be used to provide accessible voting if additional safeguards are adopted. California Secretary of State Kevin Shelley recently outlined such a plan, mandating that counties be allowed to use already-purchased DREs under two conditions: DREs must either be equipped with a VVPAT, or they must meet 23 additional security requirements and voters must be allowed to vote on a paper ballot if they so desire. This stopgap solution preserves accessibility for disabled voters and increases election integrity.

It is now clear that DREs have serious problems, many of which stem from inadequate testing procedures or the failure to follow those procedures. At a minimum, every DRE voting technology should be subjected to public “red team” testing, should use only certified election code, and should provide voters with paper ballots upon request.

a.

Certified Code - Software used in elections is required by law to be certified and verified, then held in escrow by election officials who can audit its installation. However, voting machine vendors have repeatedly violated that law, sometimes with the knowledge of election officials, by installing uncertified software on DREs used in real elections.29 This not only introduces unknown code, it also undermines the ability of election officials to use escrowed code to determine if tampering has occurred. Robust performance and security rely on minimizing unknown threats and addressing known problems; failure to follow these basic legal requirements puts our elections at risk.

b.

Red Team Testing - Federal and state certification processes do not currently include time-limited simulations where professionals attempt to subvert a mock election, also known as “red team” attacks. This kind of testing is extremely valuable because it clearly illustrates vulnerabilities while providing a blueprint to correct them. To date, only one red team attack has been conducted with a real voting machine, and it exposed serious problems.30 All DREs should be subjected to this kind of testing, and subsequent recommendations should be made public and then adopted.

c.

Paper Backups - In addition to these steps, election jurisdictions should prepare to provide voters with paper ballots upon request. Every state has procedures for absentee and provisional balloting, and those procedures should be extended to voters who choose not to use a DRE that cannot be audited.

The Road Ahead

American election reform remains a process of years, not months. With a presidential election on the horizon, we understand that only some improvements can be accomplished by November, and others must be deferred. EFF believes that long-term changes like the introduction of open source voting solutions and clear technical standards for accessibility and auditability are important components of a healthy election environment. However, we understand that these goals are not likely to be realized before the next election.

Summary

Recent exposure of problems in electronic voting systems has led to widespread calls for a voter-verified paper audit trail (VVPAT). However, some claim that accessible, auditable voting systems do not exist and that the public must choose between the rights of disabled voters and verifiable elections. We reject this false choice. Accessible, auditable voting systems have been nationally qualified and can be purchased today. Even more will be available in the coming months. We instead call for cooperation in the ongoing effort to improve accessibility and auditability in election technology.

1 Election Data Services, New Study Shows 50 Million Voters Will Use Electronic Voting Systems, 32 Million Still with Punch Cards in 2004 (February 12, 2004), at http://www.electiondataservices.com/EDSInc_VEstudy2004.pdf.

2 See, e.g., Vivica Novak, The vexations of voting machines, CNN.COM: INSIDE POLITICS (April 26, 2004), at http://www.cnn.com/2004/ALLPOLITICS/04/26/votingmachines.tm/.

3 Three independent studies of one voting system detailed dozens of serious security problems: Tadayoshi Kohno, Adam Stubblefield, Aviel D. Rubin & Dan S. Wallach, JOHNS HOPKINS UNIVERSITY INFORMATION SECURITY INSTITUTE TECHNICAL REPORT TR-2003-19 (July 23, 2003), at http://avirubin.com/vote/; SAIC, RISK ASSESSMENT REPORT DIEBOLD ACCUVOTE-TS VOTING SYSTEM AND PROCESSES (September 2, 2003), at http://www.dbm.maryland.gov/dbm_search/technology/toc_voting_system_report/voting systemreportfinal.pdf; RABA, TRUSTED AGENT REPORT DIEBOLD ACCUVOTE-TS VOTING SYSTEM (January 20, 2004), at http://www.raba.com/press/TA_Report_AccuVote.pdf.

4 See, e.g., Rebecca Mercuri, A Better Ballot Box?, IEEE SPECTRUM, Volume 39, Number 10 (October 2002), at http://www.notablesoftware.com/Papers/1002evot.pdf.

5 For example, over 1,700 technologists - including computer science professors and security professionals - endorse a resolution requiring VVPAT. See VerifiedVoting.org, RESOLUTION ON ELECTRONIC VOTING (2004), at http://www.verifiedvoting.org/resolution.asp.

6 Electionline.com, ELECTION REFORM BRIEFING: SECURING THE VOTE (April 30, 2004), at http://www.electionline.org/site/docs/pdf/EB7_new.pdf.

7 See, e.g., H.R. 2239, 108th Cong. (2003), at http://holt.house.gov/display2.cfm?id=6282&type=Home.

8 Cosmo Garvin, The paper chase: County leaders postpone a bid for digital democracy amid fears of vote tampering, SACRAMENTO NEWS & REVIEW (June 5, 2003), at http://www.newsreview.com/issues/sacto/2003-06-05/news.asp.

9 Without accessible voting machines, many disabled voters must rely on the assistance of another person, forcing them to disclose their vote and forfeit the secrecy of their ballot. DREs are one example of accessible voting technology, and the disabled community has championed their adoption for many years.

10 AAPD, AAPD POLICY STATEMENT ON VOTER VERIFIED PAPER BALLOTS (2003), at http://www.aapd.com/dvpmain/elreform/aapdballots.html.

11 AAPD v. Shelley (C.D. Cal. 2004).

12 ElectionAccess.org, BEST PRACTICES: BALLOT TEMPLATES, at http://www.electionaccess.org/Bp/Ballot_Templates.htm.

13 James Dickson, NOT-SO-SECRET BALLOT (2001), at http://www.electionaccess.org/publications/ET2001/02_01_Dickson.htm.

14 Avante International Technology, Inc., at http://www.aitechnology.com/avantetech/home.html.

15 Avante, FIRST TRUE PIXEL-BASED OPTICAL MARK-SENSE VOTING SYSTEM ACHIEVED 0% ERROR RATE IN 1.5 MILLION VOTES (May 17, 2004), at http://www.aitechnology.com/votetrakker2/Optical%20Vote-Trakker%20Press%20Release.PDF.

16 Election Systems & Software, Inc., at http://www.essvote.com/.

17 ES&S, NEW BALLOT MARKING DEVICE FROM ES&S, AUTOMARK MAKES OPTICAL SCAN VOTING ACCESSIBLE TO VOTERS WITH DISABILITIES (April 1, 2004), at http://www.essvote.com/index.php?section=press_item&press_id=84.

18 Avante, VOTE-TRAKKER PRODUCT OVERVIEW, at http://www.aitechnology.com/votetrakker2/overview.html.

19 Avante International Technology, THE TALLY (April/May, 2003), at http://www.aitechnology.com/votetrakker2/News%20Releases/April%20May%202003% 20Tally.pdf.

20 American Council of the Blind, ACCESSIBLE VOTING FACT SHEET (2001), at http://web.archive.org/web/20020816072511/http://acb.org/washington/accessible-fact02.html.

21 Kevin Chung, TESTIMONY BEFORE CA VOTING SYSTEMS AND PROCEDURES PANEL, APRIL 22-24, 2004 (2004), at http://tinyurl.com/yrmj8.

22 AccuPoll, Inc., at http://www.accupoll.com/.

23 Accupoll, ACCUPOLL RECEIVES FEDERAL QUALIFICATION FOR ELECTRONIC VOTING SYSTEM (March 26, 2004), at http://www.accupoll.com/News/PressReleases/2004-03-26.html.

24 Supra, note 20.

25 Sequoia Voting Systems, Inc., at http://www.sequoiavote.com/index.php.

26 Sequoia, MARKETING MATERIALS FOR SEQUOIA’S AVC EDGE, at http://www.sequoiavote.com/productguide.php.

27 Sequoia, SEQUOIA VOTING SYSTEMS SELECTED TO PROVIDE UNIFORM STATEWIDE ELECTRONIC VOTING SYSTEM FOR NEVADA (2003), at http://www.sequoiavote.com/article.php?id=55.

28 Pete Klammer, Speakout: Too Much Doubt About E-Voting, ROCKY MOUNTAIN NEWS (April 11, 2004), at http://www.rockymountainnews.com/drmn/opinion/article/0,1299,DRMN_38_2793358,0 0.html.

29 The use of uncertified software in elections has been widespread and unapologetic. See, e.g., Allison Hoffman & Tim Reiterman, Secretary of State Orders Audit of All Counties' Voting Systems, L.A. TIMES, November 13, 2003, pg. B.8; Eric Halvorson & Loni Smith McKnown, Johnson County Demands Answers from ES&S, WISHTV INDIANAPOLIS (March 15, 2004), at http://www.wishtv.com/Global/story.asp?S=1712213&nav=0Ra7LXSW.

30 RABA, TRUSTED AGENT REPORT DIEBOLD ACCUVOTE-TS VOTING SYSTEM (January 20, 2004), at http://www.raba.com/press/TA_Report_AccuVote.pdf.