www.wheresthepaper.org/Evoting_BadForDemocracy.htm
Teresa
Hommel, 4/9/05
Electronic Voting – Why It’s Bad For
Democracy
Table
of Contents
A. Requirements for legitimate, democratic
elections.
B. Can computers serve the requirements for
legitimate, democratic elections?
E. Surprise random counts of small
percentages of VVPAT do not prove evote accuracy.
F. When technicians handle systems for non-technical
staff, this opens the door to fraud.
G. More problems with electronic voting and
vote-tabulating systems.
I. The alternatives are better: Lever machines.
J. The alternatives are better: Paper ballots and precinct-count
optical scanners.
K Computerized elections are a political problem.
L. Uniform technology and national
standards or control cannot create election integrity.
M. Best sources of news and information.
A. Requirements for legitimate, democratic
elections.
Election
procedures must be conducted in public before multipartisan observers. When
election procedures are concealed, errors and fraud can occur. The use of
computers prevents observation and makes elections vulnerable to fraud in new
and profound ways compared to older technologies, and therefore if computers
are used the law must require appropriate security:
All vote-recording and vote-counting must be observed as a routine
matter. Participation in the conduct of elections, observation, and verification
of outcomes should not require expertise in computers or other technical
disciplines. Election outcomes must be easily verifiable -- and verified --
without technological or legal obstacles.
Elections
should be about voters selecting our public servants, not about computers and
technology. Elections should not require citizens to trust the word of
technologists that computerized procedures were appropriate and
computer-generated outcomes accurate, or force citizens and candidates to try
to prove irregularities with circumstantial evidence (such as disparity between
exit polls and announced outcomes) because of technological or legal barriers
to direct observation of ballot-recording and vote-counting, or barriers to
obtaining or viewing documents from Boards of Elections.
B. Can computers serve the requirements
for legitimate, democratic elections?
People
cannot observe what a computer is doing in its internal memory. This is a
problem if computers are used to record and/or count votes.
To solve the
problem, Dr. Rebecca Mercuri
(www.notablesoftware.com/evote.html )
developed the concept of voter-verified paper audit trails or VVPAT. The
proper use of VVPAT converts both vote-recording and vote-counting to
paper-based procedures, which enables people to observe.
1. Problem:
A voter can't tell if his or her ballot is being correctly recorded in computer
memory.
Solution:
During the election, the voter-verified paper ballot enables each voter to
observe that his or her votes are recorded correctly on paper (a permanent,
non-electronic material).
2. Problem:
No one can observe the computer’s internal tally process or confirm its
accuracy.
Solution:
After the election, an audit of the VVPAT enables election observers to
observe that the votes on paper ballots are tallied correctly, and that any
discrepancies between electronic tallies and paper tallies are reconciled.
An audit of
an election conducted with electronic voting systems with VVPAT starts with a
count of the votes on the voter-verified paper ballots, after which all
discrepancies between the electronic and VVPAT tallies are reconciled.
Dr. Douglas
Jones of the University of Iowa and three-time chairman of Iowa's board of
voting system examiners, in a recent email, described part of the
reconciliation. (Dr. Jones’ web site is
http://www.cs.uiowa.edu/~jones/voting/ )
The electronic record and the printed record are both viewed as
fallible and subject to subversion. A
hacker can hack into a computer and corrupt data. A counterfeiter can print up counterfeit ballots and swap them
for the real ones. We can adopt
technical means to defend against either attack, but if we adopt laws that say:
In the event of a disagreement, the paper dominates.
Then all you need is a good counterfeiter, while if your rules say
In the event of a
disagreement, the electronic copy dominates.
Then, all you need is a good hacker. The rule I would prefer to see says:
In the event of a disagreement, an investigation must be
initiated in order to
determine which copy is most likely to be correct...
The rules could go on at length about what other things to
examine, such as poll books, event logs, exit polls, and other evidence that
could serve to corroborate one or the other copy.
In other
words, there should be both an investigation into the conduct of the election
(to determine whether there were irregularities by people) AND examination of
the computer hardware and software (to
determine whether the computer was hacked or made an error).
It is
unlikely that audits as described above will be done. Boards of Elections do
not have the staff, expertise, or resources to examine or correct their own
election software. This would require thorough knowledge of the software used,
but all major vendors claim that their software must remain a trade secret.
Errors found but not corrected would continue to cause problems in later
elections.
In the
Information Technology world, we recognize that computers provide speed but
audits provide accuracy. Companies do complete audits of their computer systems
on a continuous basis, because that is the only way to find and correct errors
which would otherwise cause customers to take their business elsewhere. Those
customers can discover errors through the use of receipts, tracking numbers,
invoices, monthly statements, etc.
In
elections, because of the secret ballot, there are no comparable ways for
voters and candidates to detect errors and fraud. This is why proper use of the
VVPAT as described in section C. is needed.
Due to the
need for audits of elections run with evoting systems, it is clear that
computers make election legitimacy more complex, costly, and time-consuming to
achieve. It would require much less effort to fully restore and maintain lever
machines, or to securely guard paper ballots that were marked by hand and to
recount such ballots by hand before an audience of observers.
E. Surprise random counts of small
percentages of VVPAT do not prove evote accuracy.
If a
surprise random check of a small percentage of transactions could ensure the
accuracy of a computer system, no bank or other company would ever spend the
time and money to perform a complete audit.
Yet the idea
of counting only a small “statistically significant” percentage of the VVPAT
appeals to many -- it acknowledges the limited resources that we allocate for
elections; it enables our Boards of Elections to avoid the time and expense of
counting all the VVPAT. For example, a bill in the New York state legislature
would require counting 3% of the VVPAT. The bill does not require an audit or
reconciliation of discrepancies, does not require 100% accuracy, and does not
require the public to be informed of any discrepancies discovered.
Problems
with counting only 3% of the VVPAT include:
1.
Trust-the-statistician vs. observation. If observers can watch the count of 3% of the ballots cast, then
the election has 3% legitimacy.
After the
November, 2004, election, discussions about "statistically significant
percentages" flooded the internet as experts tried to analyze the numbers,
but most citizens are not statisticians.
If only 3%
of the VVPAT is counted, and is considered significant, most citizens would be
forced to trust the statisticians that 3% is in fact a statistically
significant percentage, and would be unable to confirm the math or the theory
of statistical significance. In effect, a degree in math or statistics would
become the new requirement for voter confidence.
Moreover,
statistical significance may be an inappropriate consideration. Each different
ballot design involves different computer programming for vote recording and
vote counting. There is no reason to believe that if ballots are counted correctly
in one district, they would be counted correctly in other districts where the
ballot design is different, requires different programming, and can generate
different errors.
2. Corporate
control of vote-counting. If
3% of the VVPAT is counted, 97% of vote counting would be in private rather
than public hands, raising questions of corporate partisanship, as well as
motivation and opportunity for fraud.
3. Some
types of computer errors and fraud may not show up in small samples. These include:
a.
Intermittent
errors or fraud triggered by particular combinations of votes and/or particular ballot
designs.
b.
Legally
"insignificant" vote switches per machine. A study by Yale students showed that with
a single statewide system, centralized manipulation is facilitated and can
swing elections with one or two vote switches per machine. This is why, when
computers are used, 100% accuracy must be mandated. The study: www.wheresthepaper.org/p43_di_franco.pdf (requires Adobe 6.0). Comment on it: www.wheresthepaper.org/CACM_YaleStudy.htm
4. Creation
of two classes of voters. 3%
of voters would cast ballots that were confirmed to be tallied correctly. 97%
of voters would cast ballots that were not.
5. Mandate
for unverified elections. The
requirement for only 3% of the VVPAT to be counted puts the burden on
candidates and voters to pay for counts of the other 97%, or to struggle in the
courts for the right to verify an election in a timely manner before
certification of outcomes.
One trigger
for recounts has been a “close election,” but this concept is appropriate only
to older technologies, such as paper ballots and lever machines. With
computerized voting, falsified tallies can easily be made to provide any margin
of victory.
A proposed
trigger for recounts is disparity between pre-election or exit polls and
announced outcomes. But in 2004, pre-election polls were manipulated (“Gallup
defends results against MoveOn.org attack," USA Today, 9/29/04) and in
November, 2004, exit polls as reported in the major media were
changed to match the announced tallies. ("Why Did CNN Change Their Exit Poll Data for Ohio After 1:00
AM?" www.buzzflash.com/analysis/04/11/ana04025.html
)
6.
Electronic voting and vote tabulating systems should not be treated as exceptions
to professional Information Technology standards, which require 100% audit,
100% accuracy.
100% of
computer systems comparable to voting systems are 100% audited, and
discrepancies are reconciled to achieve 100% accuracy. The phrase
"comparable to voting systems" means computer systems that capture
transaction information from the human world into electronic memory (such as an order to purchase by mail, or a
financial transaction).
The idea
that counting 3% of the VVPAT is sufficient to prove integrity of 100% of
computer operations is based on several false premises:
a.
Computers
are accurate and secure unless proven otherwise.
b.
If one
computer is proven accurate, hundreds of other similar computers are also
accurate.
c.
Elections
are like a court of law where a piece of technology, or an unobserved
procedure, should be assumed accurate until proven inaccurate.
These and
other false premises, such as “if the chief election official of a jurisdiction
trusts the computers, the computers are trustworthy,” have been used to evade
the routine auditing to which all commercial systems are subject.
Computer
systems are merely tools created by people, and are always error-prone and
vulnerable to manipulation by insiders. 100% audits, including reconciliation
of discrepancies to achieve 100% accuracy, have been the only way to achieve
accuracy of operation. In the Information Technology world, one common
definition of computer security is "the results of normal operation have
been proved correct by independent audit."
Most people
understand that 100% audits with 100% accuracy are needed to prevent or detect
financial fraud, but don't apply this understanding to computer systems used
for voting and vote tabulation. Obviously audits are needed in both worlds for
the same reason.
If you find
an error on your bank statement, and a bank officer says, "our records are
never perfect, and we didn't audit your account this month because our 3%
random check said we were accurate enough," that would be unacceptable. It
should be unacceptable in elections.
One unspoken
argument is that elections CANNOT be held to routine Information Technology
standards – because in real life Boards of Election cannot perform computer
audits. They lack not only the intention or will, but the legal mandate,
expertise, staff, and funding. This is why any law that allows use of evote
equipment must mandate and fund training of elections staff prior to use,
require vendors to provide thorough training on their equipment, and ban vendor
service contracts.
F. When technicians handle systems for
non-technical staff, this opens the door to fraud.
The vast
majority of election professionals are not computer experts. Once they acquire
and begin to use electronic voting systems, they become dependent on vendor
technicians to handle the computers. They can’t monitor what's going on because
they don't know the technology.
For example,
a technician might say, "I better check the files." Who would
question that? Or understand the answer if they do ask? Yet a brief
unsupervised access to the computer is a large-enough window of opportunity for
someone to falsify an election.
Given the
public exposure of voting systems, and the fact that in most cases they are overseen
by non-technical staff, it would be impossible to control what software is in
the computer during the election, or to prevent later tampering with software,
ballots, and tallies by insiders or technicians.
The Triad
incident in Hocking County, Ohio in December, 2004, is an example. Prior to the
recount in Hocking County, a Triad technician told non-technical election
officials that the county’s tabulation computer needed a new battery. He then
took apart the computer and possibly put in a “patch” (different software).
When the story was publicized there was an outcry. Yet the deputy director of
elections, Sherole Eaton, said that she trusted the company, that they “ran”
the elections for the county, and that “A lot of the [election] boards hire the
company that [makes] their program to come in on election night and do all of
the computer work and run the tabulators….”
Affidavit of Sherole Eaton, 12/13/04, www.bluelemur.com/index.php?p=494 "Ohio Recount Stirs Trouble" Kim
Zetter, Wired News, 12/20/04.
www.wired.com/news/print/0,1294,66072,00.html
Large Boards
of Elections have computer staffs, but these employees aren't running elections
and overseeing the handling of the voting or vote tabulating equipment. Also,
these employees may not be security experts.
G. More problems with electronic voting and vote-tabulating
systems.
1. They
don’t work reliably.
VotersUnite.org
has compiled a 97-page list of documented failures of evote systems from seven
vendors (www.votersunite.org/info/messupsbyvendor.asp ). This list includes
primarily dramatic visible failures, such as machines that freeze,
crash, or refuse to register votes during an election; incidents where the
voter selects one candidate but the computer screen registers the vote for a
different candidate; machines that fail to show some races; elections where the
number of ballots or votes is dramatically different from the number of voters;
etc.
However,
each visible failure usually means that many other failures are occurring which
would be revealed only by an audit – votes recorded or handled incorrectly and
wrong final tallies. Yet there has never been an independent audit of any
electronic voting system, and in the absence of voter-verified paper ballots,
such audits cannot be performed. For this reason, the accuracy of recorded
ballots and final tallies cannot be proved, and the extent of errors is
unknown.
Only in the
professional field of elections have such repeated computer failures been
ignored or tolerated, and defended with unfounded assertions such as “The
election outcome was not affected” and “the problems were caused by voters (or
poll workers, etc).” It is bizarre that such failures have not caused Boards of
Elections to stop using computers and seek alternative voting technology, nor
to demand routine auditing of their evote systems.
Studies that
claim to prove the accuracy of evote systems, or compare evote systems to other
voting technologies, have merely accepted the tallies provided by the computers
-- and elections officials
-- and
assumed that they are accurate. The recent CalTech/MIT study on residual votes
in the 2004 election is an example.
www.vote.caltech.edu/media/documents/vtp_wp21v2.3.pdf
2. Federal
Certification does NOT mean that a voting system works.
Despite
hundreds of documented visible failures of certified voting systems, and the
fact that no evote system has ever been audited, some people still believe that
certified systems are guaranteed to work -- until they read an interview in
which an authoritative person states that certification does not involve
comprehensive testing and does not require the system to work.
Federal
certification means that “[an electronic voting system] has to have [certain]
functions. But it doesn’t have to work."
This candid
statement comes from the I-Team interview with executives of MicroVote, which
makes electronic voting systems.
www.wishtv.com/Global/story.asp?S=1647598&nav=0Ra7JXq2
3.
Unintended use of uncertified systems.
Another problem
is that vendors can deliver or install uncertified versions of their hardware
and software. Due to the lack of computer knowledge within Boards of Elections,
uncertified systems have been used without anyone noticing until after one or
more elections. This has occurred in California, Indiana, and other states. In
the absence of an independent audit of the election, there is no remedy other
than to run another election. This has not been done. Instead, the public is
given the unfounded reassurance that “We are sure that the election outcome was
not affected.”
4.
Communications devices, Flash memory devices.
Communications
devices, including wireless ones, in voting and vote tabulating equipment
should be banned because they enable undetectable modification of all software,
ballots, and tallies by individuals in remote locations.
Regular
expert inspection of electronic voting systems must be required and funded to
ensure that communications devices do
not somehow appear. There must be criminal penalties for violation of this ban.
Dr. Mercuri
told a story once of inspecting a particular evoting machine. The sales
material and the salesman had said there were no communication devices in the
system. She asked to look inside; the salesman opened it up, and there was a
wireless communications device. She said, Oh, I see you have a whatever-it-was.
The salesman slammed the unit shut and escorted her to the door.
Communications
devices also make the secrecy of the ballot increasingly vulnerable as vendors create
“integrated election systems” that verify the identity of the voter, present
the correct ballot for their election district, and then record their choices.
Flash memory
devices pose another danger. These devices now look like wristwatches, pens, and
cigarette lighters, and would not be recognized by non-technical staff. A
technician who is not supervised by knowledgeable staff can copy the entire
election software and data, including ballots and tally sheets, etc., in less
than a minute. Later the technician can return and restore a modified copy of
the software, ballots and tallies. An entire county or state can be affected.
In contrast,
imagine someone walking off with all the paper ballots for a county or state.
Everyone would understand what they were seeing.
5. Evote
systems are easily corrupted.
A person
with moderate computer skills can read information that has been on the
internet for over a year, and then hack these systems to give falsified
election results. The hacks require only brief access. Direct physical access
is not needed because hacks can be done over a phone line and modem, a wireless
communication device in the voting system, or over the internet.
In
September, 2004, in Washington D.C., Bev Harris of BlackBoxVoting.org held a
press conference where she demonstrated how to change the votes in a Diebold
GEMS central tabulator and in a Sequoia system
(www.wheresthepaper.org/BBV_GEMSreport.htm ). Harris was dismissed by the major
media, but in fact the "Trusted Agent Report" commissioned by the
Maryland General Assembly had said the same thing in January, 2004, about the
Diebold GEMS central tabulator (they used more technical language, and didn’t
publicize the exact methods like Harris did):
"Given either physical or remote access ... it is possible to
modify the GEMS database ... without detection. Furthermore, system auditing is
not configured to detect access to the database."
-- Trusted Agent Report,
www.raba.com/press/TA_Report_AccuVote.pdf , page 21
Additional vulnerabilities were found in a study
done in Ohio, which discussed Diebold Election Systems, ES&S, Hart
InterCivic, and Sequoia Voting Systems. The Ohio Secretary of State's DRE
Security Assessment, Volume 1 of November 21, 2003, is a 46-page Summary of
Findings and Recommendations produced by InfoSENTRY Services, Inc.
http://serform.sos.state.oh.us/sos/hava/files/infosentry1.pdf
The full report is 280 pages.
www.sos.state.oh.us/sos/hava/files/compuware.pdf
6. Procedures
other than auditing cannot ensure election integrity.
A variety of
activities can reduce the number of errors and discrepancies than may occur
during elections, but these activities cannot ensure election integrity.
a. Hardware
and software testing. Such
testing, if accompanied by correction of all errors that are found, can reduce
the number of discrepancies and computer errors found during an audit. Due to
certification requirements and the length of time required for certification,
however, such errors are likely to remain uncorrected. (Certification can take
a year or more.)
b. Use of
open source software. Open
source software is software that is posted publicly for technologists worldwide
to read. When errors are found they are discussed on the internet and
suggestions for correction are made. Again, however, due to certification
requirements and the length of time required for certification, such errors are
likely to remain uncorrected.
c. Reading
and examination of software. If reading and examining software could eliminate errors, no
company would ever perform continuous audits. Professor Aviel Rubin, the
computer security expert who headed the Johns Hopkins team that wrote the first
report revealing the insecurity of Diebold software, has stated publicly that
no examination of software of the size and complexity of voting systems can
guarantee that the software does not contain fraudulent parts.
http://avirubin.com/vote/analysis/index.html
d. Escrow
copies of software. The
idea of keeping copies of software in escrow has many flaws. First, it assumes
that the escrow copy has no errors or backdoors in it. Second, it assumes that
if software in an election system is changed once, it cannot be changed back to
the original escrowed version. Neither assumption is true. Comparing software
escrowed one day to what is in the computer on another day will reveal only
very sloppily performed fraud.
1. The
"private and independent vote."
The Help
America Vote Act requires voters with disabilities to have a private and
independent vote, and indeed the only legitimate use of computers in voting is
to assist voters with disabilities or non-English languages to mark their
ballot privately and independently. However some accessibility advocates have
urged the use of electronic voting systems with accessibility attachments and
without voter-verified paper ballots.
Unfortunately, one strategy for disenfranchising
voters in 2004 was to focus attention on the experience of voting and to gloss
over the question of whether or not the votes would be counted. This was done
with provisional ballots, called “placebo ballots” in a report by Demos.
www.demos-usa.org/pubs/HAVA%20-%20Placebo%20Ballots%20bw%20101904.pdf
A problem
similar to uncounted provisional ballots faces voters with disabilities, for
whom the “private and independent vote” cast into an unaudited computer may
mean nothing more than a private and independent experience in a voting booth,
fiddling with some assistive devices. This is why
accessibility within the voting booth needs to be combined with verifiability
AND actual verification when computers are used to record and tally the votes.
Moreover,
electronic voting systems don’t give anybody a private and independent VOTE.
Every vote
cast on a computer is handed over to a large number of anonymous technical
people who have been responsible for the system from its initial design,
programming, testing, maintenance, storage, programming for the ballot, transportation,
and installation in the polling site. And another cast of characters after the
election.
A computer
is only an instrument created and managed by people. Every voter using the computer is being assisted by these people,
so the vote is not unassisted, private or independent. Without the complete
audit, we can’t know if these assistants are recording our ballot choices, or
counting our votes, honestly and without mistakes.
Voters who
are blind, or have visual impairments, would get accessibility, privacy, and
security if they mark paper ballots by using ballot templates like those used
in Rhode Island and in other countries. There are data-to-voice scanners that
can read the paper ballot back to the voter through headphones. There are accessible
ballot-printing machines such as Populex, and ballot-marking machines such as
the Automark, that can assist voters with a wide variety of disabilities.
www.populex.com/DPB_Intro.htm
www.vogueelection.com/products_automark.html
2. Can all
voters use the same voting technology?
Some people
have suggested that all voters should use exactly the same voting technology.
This may not
be practical or possible, because not all voters require accessibility devices
or non-English language displays.
When voters
with and without disabilities use what appears to be "the same
machine," they are not using the same software.
Voters with
disabilities will use accessibility attachments. Internally within the
computer, each attachment is managed by a "driver" (software that
handles communication between the computer and the specific accessibility
attachment) that is different from other drivers (such as those for other
accessibility devices, or the touchscreen or buttons used by voters without
disabilities). A programmer can easily identify which voters are using each
accessibility device. If an insider or technician wishes to switch the votes of
blind voters, for example, these voters can be identified because of the
devices they would be using.
Voters with
non-English languages face similar problems, because each foreign language
requires a separate font. A font is a set of graphic designs for displayable
characters such as letters and numerals. Even Spanish, which has characters
that are mostly the same as English, requires a character consisting of a tilde
~ over an "n" character, etc.
The separate
font and processing needed for the computer to display non-English language
ballots thus provide the opportunity to identify voters of specific language
groups. There have been allegations that some voting systems are designed to
enable an insider or technician to easily switch the votes by language group.
This is done by inserting some lines of Visual Basic Script programming in the
font files. Such programming might say, for example: if vote = Kerry, add 1 to
Bush-tally; if vote = Bush, add 1 to Kerry-tally.
Since paper
ballots can be printed in any language, it seems that the ballots of voters
with non-English languages would be more secure if marked by hand or ballot-marking
machine on preprinted paper ballots.
I. The alternatives are better: Lever machines.
1. HAVA
Requirements.
Jurisdictions
with mechanical lever machines can keep and maintain them, and purchase an
accessible ballot-marking device for each polling site to comply with the HAVA
requirement that voters with disabilities be able to vote without direct human
assistance.
Accessible
computerized devices can enable voters with disabilities or non-English
languages to mark or print paper ballots. Computers should not be used to
record and count votes, however, unless they are used according to professional
standards of 100% audit, 100% accuracy.
2. Lever machines can be repaired to nearly-new
condition.
All parts for lever machines, as well as service
technicians, are supplied by International Election Systems Corp., 1550
Bridgeboro Road, PO Box 70, Edgewater Park NJ 08010. Telephone 609-871-2100.
The president of the company is Richard Nowetner.
Engineers say that with proper routine maintenance, the lever machines should
work for 150 years or more. If they aren't working now, that is due to not
being maintained. Proper repair can bring them to nearly-new condition. The
most common damage is to the casters they roll on, and the repair is to attach
new casters. Most damage occurs in trucking. Damage to the metal casing is
repaired in a manner similar to car body repair.
3. Lever
machines are more secure than evote systems.
a.
Length of access time required to corrupt one or more machines versus magnitude
of effect.
Lever
machines: One person
would require access for several hours to each machine. Seals outside the
machine have unique numbers, and are not standard products that can be easily
replaced.
Seals inside
the machine would have to be broken or tampered with also, which would reveal
the tampering. These are “crush seals” which consist of pieces of lead crushed
over copper wires.
Tampering
with the mechanical parts inside the machine would require disassembly of major
portions of the machine, which would take many hours, followed by re-assembly
which would take additional hours. All this would have to be done within the
month before an election because in most jurisdictions the ballot is not
prepared until then.
Evote
systems: (1) One technical insider or hacker using
an automated script running in one computer anywhere in the world would require
less than a second access per computer and can corrupt all similar electronic
voting systems in a state through their communications devices.
(2) One
technical insider with no access to the computers can distribute a corrupt
"patch" which technicians
would install with or without knowledge that it is corrupt. This could have
happened in Georgia, 2002, where allegedly the software in the Diebold systems
was replaced repeatedly up to two days prior to the election.
(3) One
non-technical insider, hacker, or technician can falsify precinct and overall
tallies in the central tabulator, which would require less than a minute access
either directly or via communications devices.
b.
Ease of detecting corruption.
Lever
machines: With an
hour of training, one person can inspect lever machines and detect broken or
wrongly-numbered outside seals. If the outside seals are broken or
wrongly-numbered, an experienced technician can examine the crush seals and
mechanics inside the machine.
Evote
systems: With years
of training, one person can read and examine the software for years and not
find all corruption in it.
c.
Possibility of oversight provided by Board of Elections staff.
Lever
machines: Boards of
Elections have many technicians who can safeguard and fix them.
Evote
systems: Boards of
Elections have few or no computer staff who can safeguard and fix electronic voting
systems, or oversee the work of vendors.
J. The alternatives are better: Paper ballots and precinct-count
optical scanners.
HAVA
requirements can be met by using paper ballots marked by hand or an accessible
ballot-marking device in each polling site, with precinct-count optical
scanners.
Optical
scanners are computers, and pose the problem of programming errors, fraud, and
unobservable counting. For example, there were widespread allegations of
falsified tallies from optical scanners in Florida after our November, 2004,
election. These allegations gained seriousness when county election officials
refused to comply with Freedom of Information requests to view precinct tally
sheets.
Should
optical scanners be 100% audited with multipartisan observation, with 100%
accuracy required? The problems in Florida seem to suggest "yes."
The March
2001 Caltech report called "Revised and Expanded Report: A Preliminary
Assessment of the Reliability of Existing Voting Equipment" said that
lever machines, and hand-marked paper ballots counted by hand or optical
scanner, rank among the most reliable of voting systems. Summary:
www.hss.caltech.edu/~voting/Executive%20Summary.March30.pdf
Full
report:
www.hss.caltech.edu/~voting/CalTech_MIT_Report_Version2.pdf
A system
using hand-marked paper ballots, optical scanners, and ballot marking devices
for accessibility is:
1) One of
the most reliable systems available.
2)
Inherently voter-verified.
3)
Incorporates paper ballots that are easy to hand-count where necessary.
4)
Precinct-based optical scanners allow automated counting to satisfy election
officials.
5)
Ballot-marking devices meet multilingual and accessibility needs.
6) Less
expensive than evote systems both in initial purchase costs and ongoing
maintenance.
www.nyvv.org/paperballotCostsMain.htm
www.votersunite.org/info/costcomparison.asp
www.wheresthepaper.org/ny.html#BoLipariReports
1. States
and big cities that use paper ballots and optical scanners.
Illinois,
Chicago. 83% of the
population of Illinois (10 million) votes using such systems, including
Chicago. One Illinois County’s
rationale:
www.willclrk.com/votingsystem.htm#Why%20was%20the%20optical%20scan%20system%20selected?
80% of
Arizona, including Phoenix.
www.azsos.gov/election/voter_outreach/info.htm
Michigan
Secretary of State’s recommendation:
www.michigan.gov/sos/0,1607,7-127-1640_9150-43906--M_2001_5,00.html
States that
use mostly precinct-count optical scan systems also include
South Dakota
www.sdsos.gov/2000/00pripre.htm
Minnesota
www.sos.state.mn.us/election/Interactive%20Election%20Guides/HTML/15.htm
Seattle
2. Canadian
elections with paper ballots.
National and
provincial elections in Canada are conducted with paper ballots marked and
counted by hand. They use ballot templates for blind voters. Unlike the
attitudes expressed in this country in recent years that “elections are never
perfect” and “we can’t possibly hand-count paper ballots” Canadians have no
trouble hand-counting the votes on paper ballots. They expect and achieve 100%
accuracy.
3.
Hand-count methods.
The report
“How to Hand-count Votes Marked on Paper Ballots” describes several easy
methods for hand-counts.
www.wheresthepaper.org/CountPaperBallots.htm
Hand counts are
done in Vermont, and the election law of 2003 described in detail their
procedures. Some of those details were omitted in their revised law of 2004,
but the old version can be obtained from the office of the Secretary of State.
K. Computerized elections are a political problem.
The
Resolution on Electronic Voting, endorsed by thousands of computer
technologists, says "Computerized voting equipment is inherently subject
to programming error, equipment malfunction, and malicious tampering." www.verifiedvoting.org/article.php?id=5028
Every study
of electronic voting has said that systems from the major vendors are insecure
and of poor quality. www.wheresthepaper.org/links.html#sec
Many people
have trouble with their Windows PCs, and the systems are notoriously insecure,
but several of our major evote vendors have built their evote systems on top of
Windows.
A study by
Findlaw showed that in September, 2004, 42% of Americans distrusted electronic
voting.
http://company.findlaw.com/pr/2004/090704.electronicvoting.html
A continuous
flow of bad news from around our country tells us that electronic voting and
vote tabulating systems don’t work.
www.votersunite.org/info/previousmessups.asp
In spite of
all this, few government officials with responsibility for elections are
heeding the constant stream of warnings about electronic voting, and the
expressed distrust of voters. The major media and many officials are still
urging us to convert to electronic voting. In 2004 Americans witnessed an overwhelming
incidence of dirty tricks and failures of our election infrastructure, and the
use of unverifiable and unverified computers is part of this failure.
Americans
have a real need. We need election systems that work, that can be managed by
the kind of staffs who work for our Boards of Elections at the county and state
level, and that can be overseen by ordinary non-technical multipartisan citizen
observers.
Computers
can be made to work reliably through the use of audits, but no one in a
position of authority is demanding that audits be performed. Around our country
computers used in elections are being used incorrectly, accompanied by untested
trust, assertions that elections are never perfect, and statements that
elections cannot be run any other way because Americans are incapable of
counting ballots, maintaining lever machines, recruiting and training poll
workers, etc.
In states
with electronic voting, some people have suggested that if any voter doesn't
want to cast his or her vote on a computer, they should request a paper
absentee ballot. But elections are not just about "my vote," they are
about the will of the people -- all votes. Unaudited computers are the wrong
technology for elections for all voters.
A broken
democracy can’t be fixed by using unaudited computers to record and count
votes. If democracy is government "of the people, by the people, for the
people," the law needs to put people back into the center of our
elections, and not replace citizen participation by computers.
L. Uniform technology and national
standards or control cannot create election integrity.
There is a
push now for national standards for voting technology, and national control and
standardization of election procedure.
These things
won't strengthen our democracy, however, because election integrity results
from appropriate multipartisan observation. No one is proposing standards to
require multipartisan observers for all election procedures, and to require all
procedures to be conducted in a way that enables effective observation by
ordinary non-technical citizens.
Uniform
technology cannot provide uniform integrity because different insiders,
technicians, or hackers can still falsify the ballots or tallies in different
jurisdictions. Uniform technology DOES enable one insider, technician, or
hacker to falsify all systems more easily.
M. Best sources of news and information.
1.
www.votersunite.org is the best source of organized historical and current
voting system news.
2. Daily Voting
News from votersunite.org -- to subscribe send an email to John Gideon at
jgideon@votersunite.org
3. Email
clipping service, newspaper articles on voting machine and election issues from
around the country -- To subscribe send an email to resist@best.com
4. Much
information is at www.wheresthepaper.org
5. When
elections lack legitimacy, so does the government. Symptoms are arrogance,
disregard for truth, and contempt for public opinion by government officials
and institutions. For a daily email with analysis of many national subjects,
subscribe to Progress Report,
www.progressreport.org