Securing (Or Not) Your Right to Vote

By Steven Levy

Newsweek

Sept. 10, 2007 issue - Next year we'll have the second presidential election since the horribly botched one in 2000. Can we expect better? An answer comes from the highest election official in the most populated state in the Union. Worried about a string of reported vulnerabilities, Debra Bowen, California's secretary of State, had asked computer scientists at the University of California to conduct a "top to bottom" analysis of the thousands of touchscreen electronic voting machines in use in the Golden State. Next year millions of voters will use these systems, manufactured by the industry's largest suppliers, not only in California but in many other states as well.

What did the study reveal? "Things were worse than I thought," says Bowen. "There were far too many ways that people with ill intentions could compromise the voting systems without detection." Some of those security holes could, in theory, allow a dirty trickster with access to a single machine to infiltrate the central vote-counting system and covertly toss an election to the wrong candidate.

It was the most devastating confirmation to date of what security experts have been saying for years: vulnerabilities in election machines are so severe that voters have no way of knowing for sure that the choices they enter into the touchscreens and ballots will actually be counted. "The studies show that these machines are basically poison," says Avi Rubin, a Johns Hopkins computer-science professor and voting-security expert.

Bowen's response, on Aug. 3, was to take the extreme step of decertifying the voting machines (this to the dismay of those defending the touchscreen vendors, who claimed that the tests did not reflect real-world conditions). Because California voters do need something to vote on, though, she allowed the use of some, mandating a rigorous set of controls (like "hardening" the security protocols) to make sure that the flaws aren't exploited. Now it's up to those in charge of elections in other states to step up and take similar measures for 2008.

One desperately needed measure is a national law to implement what is known as a voting paper trail—the ballot equivalent of a receipt in a cash register. (Voters get to look at a printout of their voting choices and leave the paper behind for recounts and audits.) A "voting integrity" bill introduced by Rep. Rush Holt, a New Jersey Democrat, would do just that—if it ever passes. "We just didn't get it to the floor before the August recess," says Holt, who is hoping for what seems like a long shot—that the bill will be quickly voted on, a similar bill in the Senate will also get the hurry-up treatment and that the president will sign it. (The GOP has generally been less active in pushing for this type of reform.) "It's still possible [to get it done in time for '08], but each day it gets a little less possible," he says.

The paper trail is no panacea: the California study shows that even that system can be hacked. And some reformers claim that the Holt bill doesn't go far enough. But Holt insists that a national law is the only solution. "If you leave it to the states, some won't do it," he says.

It's reasonable to ask why the same wizards who can come up with ATMs, predator drones and Google can't produce secure, verifiable ballots. Eventually they will, if we encourage innovation, transparency and accountability in the ballot industry. But we're electing a new president next year, and it's so late in the game that the only measures to stop another mistrusted election are stopgaps. California's secretary of State recognizes that. Plenty of citizens get it, too. Why aren't more elected officials standing up for our elections?