Kuro5hin.org: technology and culture, from the trenches
create account | help/FAQ | contact | links | search | IRC | site news
[ Everything | Diaries | Technology | Science | Culture | Politics | Media | News | Internet | Op-Ed | Fiction | Meta | MLP ]
We need your support: buy an ad | premium membership

[P]
Electronic voting machines are a terrible idea

By Eric Green in Technology
Fri Nov 08, 2002 at 09:33:25 AM EST
Tags: Politics (all tags)
Politics

In Salon Magazine, Farhad Manjoo has an excellent article entitled Voting into the void: New touch-screen voting machines may look spiffy, but some experts say they can't be trusted. Is he right?


Count me as one of those experts who says they can't be trusted. The problem is that these machines have no audit trail. They have no paper trail. I am a software engineer whose minor in college was accounting. If I created a system for accounting for money that had no paper trail for auditors to follow, the IRS would put me into jail. Yet for some reason it's okay if we create a system for accounting for votes that has no paper trail? Since when did our right to vote become less important than the almighty dollar?

There's no replacement for paper. Even electronic cash registers and ATM machines produce paper -- they have a paper tape in them that records every transaction, so that if the electronic gadgetry goes down, the paper tape can be examined. Electronic accounting entries can be gimmicked in the computer databases, or just plain dumped into /dev/null. It's hard to gimmick up an entire roll of cash register tape -- and if the IRS audits you, the cash register tape is likely to be the first thing they want to see.

There's a number of possible ways to add a paper trail, such as having the electronic voting machine print a slip of paper with the votes on it, and the slip of paper is what's counted. The important point is that there must be a paper trail.

Luckily there already is a system that has a perfectly useful paper trail, with little modification required: The good ole' optically scanned ballot with feedback system. Numbered optically-scannable ballot cards are sent to the polling site. The elections department has a list of which ballot cards are sent to which polling site. Representatives of each party at the polling site shuffle the ballots to randomly number them. Voters come up, get a card, place it over the template, fill it out, then put it into the machine. If there is a problem with the ballot, the machine spits it back out at the voter and the voter then has to take it to the desk where elections officials sit, have them certify it as "spoiled" (witnessed by representatives of each party), and then receives a new ballot if the machine does not accept the ballot this second time. At the end of the day the officials of all parties verify that of the ballots that they received, all ballots are either accounted for, in the "spoiled" pile, or in the ballot box.

So there it is: we already almost HAVE the perfect voting system. The only real problem with this system is lack of an authentication method. There is nothing to authenticate that this ballot was cast at a certain box, and witnessed as such by representatives of the parties. But that's easy enough to solve. That's why message authentication checksums such as MD5 were invented. Just have the ballot box be a little more complicated than just a simple OCR scanner, with a little barcode printer inside it. The barcode printer would print a checksum on the ballot when it was submitted, a checksum that would basically be a MD5 sum of the precinct, box, ballot number, the votes on the card, and secret passphrases entered by representatives of each party. That solves what we call that the "authentication" problem in computer science -- verifying that a packet we receive over the network came from who we think it came from, not from someone sending us a fraudulent packet. Such a checksum would prevent someone from breaking into the warehouse where the ballots are stored, replacing the ballots with duplicates with different votes, then replacing the box (with the now-fraudulent ballots) and demanding a recount of the box. But that's the *ONLY* problem with this time-tested method of counting votes, and it's one that's easily solvable. The ballots can then be recounted simply by pushing them back through a counting machine after the party representatives enter their passphrases -- the printed checksum will verify that yes, this ballot is intact and authentic. Voila. You can even count the things by hand, for cryin' out loud, if you don't trust the machine to count.

So why the rush to get rid of the optical scanner machines in favor of the touch-screen machines that have no countable ballots? There's a number of theories here, including various conspiracy theories (mostly based around the notion that the voting machine companies are owned by Republican operatives), but the one that makes the most sense to me is the desire to do away with an audit trail that would allow a real recount. The old lever-type machines were similarly popular in areas where voting fraud was common, for similar reasons -- you couldn't do a recount. Voting officials hate recounts, and in the aftermath of the Florida 2000 fiasco (and the Florida 2002 fiasco, btw -- a news item just came across the wire that over *100,000* ballots were found today that had not been counted as part of the totals yesterday) many elections officials are saying "Not in my jurisdiction!". By eliminating the audit trail (recount possibility), they are hoping to make their own jobs easier. The notion that this is terrible accounting practice, that numbers in databases are easily altered and electronic entries don't always get into the database correctly if the software has a bug or crashes, this notion does not occur to them, because they are political hacks, not accountants.

So yes, the new touch-screen machines are cool-looking. But no, they're not more accurate, and no, they're not better than "old" technology, and yes, they offer unprecedented opportunities for vote fraud if a computer-savvy person gets to the hard drive and changes the votes, or, more likely, just plain old vote lossage (I mean, the things are based on Windows, for cryin' out loud! Of COURSE they lose data when they get the Blue Screen of Death, as happens every fifteen minutes!). This is a case where tried'n'true paper is far superior to electronic gimmickry -- and where we, as voters, should be demanding that our votes be cast in a technology where we *know* they count: good ole' paper.

-- Eric Lee Green, Scottsdale, Arizona.

Sponsors

Voxel dot net
o Managed Hosting
o VoxCAST Content Delivery
o Raw Infrastructure

Login

Related Links
o Voting into the void: New touch-screen voting machines may look spiffy, but some experts say they can't be trusted.
o the voting machine companies are owned by Republican operatives
o Eric Lee Green, Scottsdale, Arizona.
o Also by Eric Green


Display: Sort:
Electronic voting machines are a terrible idea | 112 comments (107 topical, 5 editorial, 0 hidden)
I agree and disagree (3.00 / 2) (#2)
by dani14 on Thu Nov 07, 2002 at 10:34:28 PM EST

I agree with you that a paper trail is important, and should be maintained.

However, I disagree, maybe not with you, but with the general idea that people don't understand touch screens or don't notice that they are mis-calibrated. In Pennsylvania, there are gas stations/convenience stores called Sheetz, where you can order a sandwich, made-to-order, using a Touch Screen Menu. After you complete your order, this little printer next to it gives you a receipt to take up to the register and pay. Now, first of all, why can't we have these little printers next to the election booths so you vote then take your printout to the election officials to stick in a secure box in the case of a recount? Second, if us hicks in PA can figure out how to use a touch screen with greasy fingers after filling our gas tanks, how hard can it be?

--


"The samaritans parable obviously missed the bit where jizzbug ... kicked the crap out of the guy "just to see if he could do it, you know, to test if the law was perfect and all"." -- Craevenwulfe
Is that machine really necessary? (3.00 / 1) (#13)
by dufduf on Fri Nov 08, 2002 at 01:12:29 AM EST

Why can't you just have a piece of paper and write the number of your candidate of choice on it? Sure, it takes some time to count them, but I don't think it's that much of a trouble to recruit some extras every few years to do the manual work.

[ Parent ]
nit (2.00 / 1) (#24)
by nex on Fri Nov 08, 2002 at 09:42:36 AM EST

greasy fingers actually facilitate the usage of some types of touch screens.

[ Parent ]
optical scanners vs. touch screens (3.66 / 3) (#3)
by aphrael on Thu Nov 07, 2002 at 10:37:22 PM EST

I don't believe anyone, or at the very least, anyone on a large scale, is actually in the process of trashing optical scanners for touch screens. In general, touch screens are being trotted out to replace punch cards and lever machines, not optical scanners.

The absence of an audit trail. . . (2.83 / 6) (#6)
by IHCOYC on Thu Nov 07, 2002 at 11:00:05 PM EST

. . . is actually a Good Thing.

What it actually does is filter out the ambiguities inevitably present on analog paper ballots. This gives the lawyers nothing to argue about. The binary tally is the only result the machine can yield.

In this, they resemble the old fashioned pull-lever voting machines that used to be universal here. When these machines were the only ones around, election contests could only argue about the absentee ballots, since those were the only ones that had marked bits of paper that could be claimed were ambiguous or invalid. The mechanical results were rock-solid and introduced no errors based on the faulty transmission of an intended or unintended mark onto a piece of paper.
--
"Complecti antecessores tuos in spelæis stygiis Tartari appara," eructavit miles primus.
"Vix dum basiavisti vicarium velocem Mortis," rediit Grignr.
--- Livy

No audits != perfection (4.00 / 1) (#7)
by epope on Thu Nov 07, 2002 at 11:04:31 PM EST

What if there is a flaw in the vote-counting software? Without an audit trail, there is no way to check for that.

[ Parent ]
We don't need no steenkin' software (none / 0) (#47)
by IHCOYC on Fri Nov 08, 2002 at 11:18:20 AM EST

The machines I like, and wish we had kept --- the mechanical lever counting machines --- had no software to go awry.

Heus, nunc, heus, nunc, mihi cantate hanc æruginem.
[ Parent ]

Hmm (4.60 / 5) (#9)
by carbon on Thu Nov 07, 2002 at 11:52:22 PM EST

Let me get this straight. By removing any method of verifying the results, that improves the system, since now we can simply assume that nobody's messed with it and that nothing is wrong, thus wasting no time? I... er... well... there's not much I can say in response to that. It's just brilliant :-)


Wasn't Dr. Claus the bad guy on Inspector Gadget? - dirvish
[ Parent ]
That's it, more or less (4.50 / 2) (#46)
by IHCOYC on Fri Nov 08, 2002 at 11:12:03 AM EST

Let me get this straight. By removing any method of verifying the results, that improves the system, since now we can simply assume that nobody's messed with it and that nothing is wrong, thus wasting no time? I... er... well... there's not much I can say in response to that. It's just brilliant :-)
Always glad to have my brilliance recognised. But perhaps I need to explain myself in greater detail.

I say this out of experience. Floyd County, has recently (before 2000) converted its voting equipment from the old-fashioned mechanical lever voting machines to a system with an electronic gadget, and a paper ballot. You complete a broken arrow on the paper ballot, and insert it into the machine. The machine then does some kind of internal check on what it reads on the ballot. It either accepts it or spits it out, in which case the voter gets two more cracks at producing a ballot the machine will accept.

Now, Indiana law (I.C. 3-12-1-1 et. seq.) provides for elaborate rules to determine when paper ballots can be counted. Such things as erasures, "distinguishing marks or mutilations," and various other misfeatures can invalidate an attempted vote on a paper ballot. There are also rules to determine whether such things as check marks count as votes. Indiana also allows machine votes.

The difficulty with the new system is that it creates a paper ballot with every vote cast at the electronic machine. These paper card ballots are subject to protests that throw them back into a version of the paper ballot rules. Now the historical problem with the paper ballot rules is that what constitutes a mutilation, a distinguishing mark, or an attempted vote is subject to much more argument than the mechanical tally. The local courts who supervise election contests are elected on party lines; the appellate courts are appointed by the Governor, and are affiliated with the Governor's political party as well. The politicised courts seize on ambiguities in the paper ballots, finding ways to count favourable ballots in the contested election and rejecting the other party's votes.

The old voting machines, at least, were immune to this sort of finagling. Their process of registering votes acted as a filter that removed any even slightly ambiguous result, and no paper ballot was there to argue over. Now that we have a paper ballot as well as an electronic tally for each ballot cast, every vote is potentially subject to political and lawyerly manipulation. This is not an improvement in my eyes.

Heus, nunc, heus, nunc, mihi cantate hanc æruginem.
[ Parent ]

You're right (4.50 / 4) (#8)
by CaptainSuperBoy on Thu Nov 07, 2002 at 11:08:58 PM EST

You're right about the touch-screen voting machines. On election night they showed a report about how poorly calibrated machines were registering the wrong vote, and I cringed when I saw the interface. As anyone who's used a touch screen knows, you need big buttons - but on the voting machines the candidates were closely spaced, in tiny rows. Because of poor calibration and different viewing angles, a voter could easily press the right candidate and have the machine register the wrong one. Touch screens have absolutely no place in a mission-critical system like voting. I wouldn't be surprised if a large percentage of voters got their votes wrong because of a touch screen's drawbacks.

--
jimmysquid.com - I take pictures.
Well, then. (4.33 / 3) (#10)
by ekips on Fri Nov 08, 2002 at 12:22:47 AM EST

I mean, really, is it that big of a deal to manufacture machines that print out a card?  And is it really that much of a hassle to add two simple things: a bigger interface (maybe one issue per screen; one screen for prez, one screen for governor, one screen for measures/props .. etc), and a confirmation after each "Okay" that tells you the vote it's going to register and makes sure you're okay with that?

Touch screens may not be appropriate for mission-critical things like voting right now, but it seems that with a couple simple tweeks, they could be.

And what about all those trees we're currently saving with paperless voting?  Simple.  Print the result cards on tree-free paper (I just bought some from Staples; $7/ream, 90% post-consumer recycled paper, 10% hemp).  Simple?  Simple.

-----------------

This is a test of the Emergency Broadcast System. If this had been an actual emergency, do you really think we'd stick around to tell you?

Electronic voting is good (4.28 / 7) (#14)
by fluffy grue on Fri Nov 08, 2002 at 01:22:33 AM EST

But touchscreens are bad. Here in New Mexico we've used electric voting machines for years, and we have very few (if any) problems with them. The voting machine keeps a paper trail (it has a printer securely locked up inside), it doesn't have the problem with touchscreens (it's a very large membrane touchpad with discrete buttons), it lets you change all of your choices until you're Done, it provides very good feedback to show you what you have to do next, and write-in votes are handled with a simplified keyboard.

Electronic voting machines as a whole aren't problematic, the problem is that the newest wanky "toys" being used are being designed by people without a clue when it comes to the limitations and design requirements of the technology they're using.

Personally, I think that touchscreens are horrible. They have no tactile interface, no possibility for Braille (whereas the membrane pads can have Braille text on them, nicely superimposed over the regular text), and as you said, they're amazingly inaccurate and require calibration, which is a much more involved process than is feasible for a large-scale short-term deployment (such as an election). But that doesn't mean that all methods of electronic voting are fundamentally flawed.
--
"Is a sentence fragment" is a sentence fragment.
"Is not a quine" is not a quine.

[ Hug Your Trikuare ]

Still not good enough. (4.00 / 2) (#29)
by haro on Fri Nov 08, 2002 at 10:12:27 AM EST

But touchscreens are bad. Here in New Mexico we've used electric voting machines for years, and we have very few (if any) problems with them. The voting machine keeps a paper trail (it has a printer securely locked up inside)

This makes it possible to show that the count is the same as what is printed inside. That is good, but how do you know that your vote is indeed what was printed and counted? Crack the machine and let it once in a while record and print your party and count your party when the vote was against you.

A second problem is that your vote is no longer completely secret. If someone could record who voted on the machine and in what order, the print would reveal who voted what.

[ Parent ]

Order is still unknown (4.00 / 1) (#49)
by fluffy grue on Fri Nov 08, 2002 at 11:26:50 AM EST

First, they don't record the order in which people come in (it's not like the whole process is electronic; registration is still done by crossing a name off on a paper list). Next, they have multiple booths in a single polling place (each with a curtain), and the order in which the booths is used is randomized simply by the nature of the fact that some people take longer to vote than others (it's a single line for all of the booths). So the vote is still secret.

And yeah, theoretically the vote could be recorded wrong, but that would require a vast conspiracy on many levels in order to even get one booth subverted in that way.
--
"Is a sentence fragment" is a sentence fragment.
"Is not a quine" is not a quine.

[ Hug Your Trikuare ]
[ Parent ]

What about auditory information? (5.00 / 1) (#57)
by Dephex Twin on Fri Nov 08, 2002 at 12:26:01 PM EST

Personally, I think that touchscreens are horrible. They have no tactile interface, no possibility for Braille (whereas the membrane pads can have Braille text on them, nicely superimposed over the regular text)
I was listening to NPR yesterday, and a man called in talking about how, even though he was blind, he had gotten to vote on his own for the first time ever at this election (Unfortunately I don't remember the state he was from). He said that they just got new electronic voting machines, and that they had a feature where you could put on headphones and listen to the choices being read by the computer. According to him, it used a really high quality, easy-to-understand synth voice, and he sounded really pleased to be able to do this. Anyway, not that I actually am a fan of touchscreen voting or anything... I just wanted to mention there was something (at least in one state) to account for the blind.


Alcohol: the cause of, and solution to, all of life's problems. -- Homer Simpson
[ Parent ]
That's a good way to do it too, yeah (none / 0) (#58)
by fluffy grue on Fri Nov 08, 2002 at 12:30:08 PM EST

Probably better than Braille in general, actually, since Braille is only useful for people who have been blind since childhood. (It's extremely difficult for adults to learn.) But the auditory voting has little to do with the voting system using a touchscreen; any electronic voting system could fairly easily be adapted for TTS.
--
"Is a sentence fragment" is a sentence fragment.
"Is not a quine" is not a quine.

[ Hug Your Trikuare ]
[ Parent ]

True (none / 0) (#75)
by Dephex Twin on Fri Nov 08, 2002 at 01:43:04 PM EST

Like I said, I'm not saying this is inherently good in touch screens or that touch screens are even good (I think they aren't), I'm only saying they aren't deficient in that regard.


Alcohol: the cause of, and solution to, all of life's problems. -- Homer Simpson
[ Parent ]
got several points wrong (4.33 / 3) (#15)
by nex on Fri Nov 08, 2002 at 04:09:15 AM EST

Eric, I agree that the possibility of recounting votes (preferably in a time-efficient manner) definitely has to exist. I agree that data loss has to be prevented by all means, and voting fraud even more so. But I think that sticking to methods that you supposed to be 'tried and true' are not necessarily the best solution. Let me bring a few points in which your argumentation is flawed to your valued attention:

> If I created a system for accounting for money that had no paper
> trail for auditors to follow, the IRS would put me into jail. Yet for
> some reason it's okay if we create a system for accounting for votes
> that has no paper trail?
These are not comparable. The system for accounting resides at the location and in the possession of a company that possibly might want to to fool auditors. The voting machines are under the control and observation of the same people who would otherwise control and observe ballot boxes.

> There's no replacement for paper.
Why do you think so? Of course, present-day electronic cash registers and ATM machines have electronics that are likely to lose data in certain situations, which occur more often that a fire or something else that would also destroy the paper records. But they are constructed that way because their technology is so old that it would have been a total waste of money if they were built to be much more secure, because you have the hardcopy anyway. Going for the dead trees solution was more economic and sensible. People also didn't trust integrated circuits very much, because those they knew (well, mainly the software they ran) were rather faulty.

But today, you can save data electronically in a way that makes it much harder to alter/forge afterwards, so it's much more of a proof of what really happened. You can store it in devices that survive much harsher conditions than paper. So, of course you can replace paper.

> So there it is: we already almost HAVE the perfect voting system.
This estimation is totally superficial and narrow-minded. You didn't consider the maths of how the votes are counted. Have a look at this recent /. article, which mentions that ...

Mathematics are shedding light on questions about how well different voting procedures capture the will of the voters.' The verdict: the U.S. system might be the worst of the lot.

> ... including various conspiracy theories (mostly based around the
> notion that the voting machine companies are owned by Republican
> operatives
In this respect, your invention, the OCR scanner that prints barcodes with checksums onto the ballots, wouldn't be much different. If the hardware is corrupted, it can submit compromised results. Your barcodes should prove the origin of a ballot, and you have secret passwords for security. But if someone builds a back door, a security hole, into the machines, whoever has access to the security hole also has access to the passwords and they are no longer secret.

No, all these points are right (none / 0) (#70)
by wumpus on Fri Nov 08, 2002 at 01:13:36 PM EST

These are not comparable. The system for accounting resides at the location and in the possession of a company that possibly might want to to fool auditors. The voting machines are under the control and observation of the same people who would otherwise control and observe ballot boxes.

Are you doing away with the secret ballot? I thought that election observers where not allowed to observe each person's vote.

The problem here is simple.
You have a voter, who makes a vote that can be checked by:
1. the voter (this should involve a printout)
2. the observes
3. the machine doing the counting.

The reason a printout is needed is to avoid the "hanging chad" problem. If the voter agrees that the printout is correct, he stuffs it in the ballot box. There should not be any interpretation required to read the ballot in the ballot box.

Once the voter can determine that his vote has been correctly read he "pulls the switch" and has it counted. Then puts the printout in the ballot box. The observers need to be able to determine that the machine correctly counted the vote (counting a subset and noticing the percents are "close enough" will suffice. The candidates should be able to easily add up each precinct to check the actual vote.

Breaking any one of these steps allows the voting booth manufacturer to easily and undetectably rig elections.

Wumpus

PS. I am ignoring the bit about the Science News article. That issue is completely orthogonal. One thing it ignores is how resistant the electoral college is to cheating. To steal the electoral college, the stealing party has to change a vote from a minority in a state (which presumably has many members of the other party in power) to a majority. This is far different from stuffing ballot boxes in "safe" states, overwhelming votes in other states. Note that before 2000, the last disputed election involved Nixon questioning the Chicago graveyard vote wining over the Republicans in downstate Illinois.

[ Parent ]

Disagree (4.75 / 4) (#16)
by barnasan on Fri Nov 08, 2002 at 04:13:36 AM EST

Don't think that a "paper trail" is important. A trail, yes, but does it have to be paper? Don't think so.

First, what you write about ATMs might be true, but do you think that every time I make an online transaction, or buy some stock, somewhere, in the basement of a bank there's a printer that actually prints my transaction to paper, just for the sake of a paper trail? I'd be surprised.

Second, paper has it's own problems too. For instance, you can't beam it instantly to the other side of the globe, or search and sort it fast, like binary data. OTOH it burns very well.

As I said, a trail is important. But, come on, this can be solved electronically much more secure, faster and more reliable than paper. You need standards, you need clear criteria what the system should do, and you need good programmers. As suggested above, banks should be good candidates for having lots of practical knowledge in building systems that create reliable "electronic trails".

You can write it into different databases at the same time. You can even make a "physical" screenshot in the moment the person touches the screen and store it in another database. Then you can actually go back and really examine what the voter saw on the screen and try to figure out what he meant. Wouldn't this be equivalent to a manual recount?

Some people think that paper has been there forever. It has not. It's one way of documentation, and most definitely there are (or at least will be, I'm sure) better alternatives. I, for one can't wait for ebook to really take off, and will be glad once all this paper around me goes away (replaced by "electronic paper" or whatnot). But I'm getting offtopic....

disagree w/ disagreement (5.00 / 2) (#37)
by memfree on Fri Nov 08, 2002 at 10:44:03 AM EST

As the article points out, a paper is "readable by most humans". That is the primary reason it makes a good choice for use in verification.

Where I vote we still use punch card ballots, and you can see the holes (but no names). Further, since each ballot is numbered, and that number is recorded in a book next to our names, it isn't completely anonymous. Someone *could* come back and verify that my ballot actually reflects my vote. This could be used against an individual if the election officials were corrupt, but I like it as a better plan than letting voters take a copy of their ballot with them (which can lead to folks exchanging proof of certain votes for rewards). However -- and since I live within a couple blocks of my election officials -- I am in a position to cause a stink if I caught them doing bad things with the votes.

While it is possible that an electronic voting system could be developed to output how a person voted (for verification purposes), I think it better for doing so to take a large effort instead of an easy data query that could spit out how each person voted. Still, *that* would be better than putting all faith in the software. Anyone want to suggest other ways to keep voting records sealed, but verifiable?

[ Parent ]

Proof of one's vote... (none / 0) (#112)
by vectro on Fri Nov 29, 2002 at 02:24:46 PM EST

... is easily obtained with a vote-by-mail ballot.

Besides which, politicians sell their votes, why shouldn't the citizens get a piece of the action?

“The problem with that definition is just that it's bullshit.” -- localroger
[ Parent ]

So.. (5.00 / 2) (#63)
by Kwil on Fri Nov 08, 2002 at 12:50:37 PM EST

First, what you write about ATMs might be true, but do you think that every time I make an online transaction, or buy some stock, somewhere, in the basement of a bank there's a printer that actually prints my transaction to paper, just for the sake of a paper trail? I'd be surprised.

So you're surprised then. It doesn't make it any less likely, because in fact, this is exactly what does happen. Every ATM and cash register has an internal paper tape. Every charge your credit card company makes on your card goes on to a paper tape.

When you buy stock there are actually three separate paper trails that occur that you never see.

Why do you think we need to sort and search the paper quickly? This is why we have electronic records, after all. The paper trail is there as a backup. It is used as final proof should there be some question as to the results. Hence the term "audit". Other than that, it's not used, and usually destroyed 3-10 years after creation.

The other problem with electronic voting is that the mechanism, currently, is completely opaque. You say you're voting for A, the machine tells you you voted for A, sometime between when you vote and when the votes are tallied, a bit is flipped - whether by sloppy programming, static interference, power glitches, or hacking, and now you voted for B.

Okay. Mistakes happen by paper too. The key difference with this is that not only do you not know about the mistake but you can't know about the mistake because of the design of the system.  Recounts will generally not be done if the vote is overwhelmingly in favor of one candidate over the other, but if it is a bit of poor or malicious coding buried six layers deep in the security protocol that changes every 8th vote for A into a vote for B, what do you do then?

Also, your three requirements miss one very important one. The programmers also need to be trustworthy. This is why there needs to be some sort of verification that simply is not subject to electronic interpretation.

Well what about an open source solution then? Great! Except how do we know that what is proposed and developed is actually what is implemented on the machines at voting day? Swap some critical files somewhere between program freeze and installation and now we have the same problem, in some ways worse because people will "trust" the system to not make mistakes.

The difficulty with electronic voting is that it only takes one small change to effect millions of votes unless you can develop the perfect security system (which is quite simply impossible). Paper voting has its problems, but it generally takes  a hell of a lot more work to change millions.

That Jesus Christ guy is getting some terrible lag... it took him 3 days to respawn! -NJ CoolBreeze


[ Parent ]
It's not a bad system (3.25 / 4) (#17)
by squigly on Fri Nov 08, 2002 at 05:01:38 AM EST

It really needs to be something marked by pen or pencil.  This allows easy manual verification of a random sample, or a total manual count if the mechinsim completely screws up.  It's very easy to count slips of paper with a thick black mark on them, and there's a lot less of a possibility of ambiguity.  They could also be sorted into separate boxes, then we can also verfiy who the winner is if it's a total landslide, and also flick through the winner's cards to check that all the voters voted for him.  A vote in the wrong place will stand out a mile.

I'd still reccomend hand counting.  Ballot slips simply have all the tick boxes at the right hand side.  This means that to count them, the counters just need to lay them on top of each other, overlapping (Double sided sticky tape is useful here), and count the ticks in each row.  Finding people to do this is not too hard.  The parties will happily supply volunteers.  

Finding people isn't the problem. (5.00 / 1) (#30)
by Control Group on Fri Nov 08, 2002 at 10:13:16 AM EST

The problem is trusting them. I'm entirely in favor of maintaining a paper record, but I am entirely against counting on people to count anything. How many times do you suppose the average person (average == !rain_man) would have to count the people in his section at a baseball game before he came up with the same number twice? (Unless you're in Milwaukee or Montreal, in which case the answer is two - counting to three is real easy). The machines have to be tested thoroughly before the election to see how they respond to malformed ballots; spot checking can be done during the election to make sure that the machine's interpretation of the ballot matches that of a person (have the machine print its reading on the ballot and have someone check it).

Come to think of it, you could even have people go through every single ballot and compare what they think the vote means to what the machine printed on the ballot. Bring on the human oversight - as you said, it shouldn't be hard to find volunteers.

But we, as a society (perhaps even as a race) need to stop thinking that people are more reliable than machines. We quite simply aren't. We exhibit far better judgement*, can deal robustly with the unexpected, are capable of intuitive leaps, and enjoy the ability to be creative. But we're not reliable, consistent, or particularly accurate. And ballot-counting relies far more on the latter set than on the former.

*Of course, since judging the quality of human judgement is a judgement made by humans, this should come as a surprise to no one.

***
"Oh, nothing. It just looks like a simple Kung-Fu Swedish Rastafarian Helldemon."
[ Parent ]

People vs machines (none / 0) (#45)
by squigly on Fri Nov 08, 2002 at 11:11:11 AM EST

I think the main problem is the type of machine.  the punch card readers seem to be a little flakey when it comes to incompletely punched holes.  The act of sending it through the machine can dislodge them, resulting in different results in a recount.  

On the other hand, a mechanism that can read a number of pencil marks on a sheet of paper works rather well.  I have a lot of faith in these.  They seem to work remarkably well for the National Lottery.  Perhaps it would need some modification to work for some older shakier people.

Does anyone have an indication of how accurate a hand count actually is?  There must have been enough recounts in a major election to get reasonably reliable figures for this.

[ Parent ]

Consistency can be a problem. (5.00 / 1) (#53)
by Kwil on Fri Nov 08, 2002 at 11:53:12 AM EST

Being reliably and consistently wrong about something (such as missing a vote because it was not punched quite far enough) can be far worse than being occasionally mistaken. Especially in something where what we need is accuracy more than consistency.

With machines, if a mistake is made somewhere, that mistake will be reliably duplicated in every iteration. Is this really what we want for voting?

That Jesus Christ guy is getting some terrible lag... it took him 3 days to respawn! -NJ CoolBreeze


[ Parent ]
I agree (none / 0) (#71)
by Control Group on Fri Nov 08, 2002 at 01:21:39 PM EST

Which is why I'm entirely in favor of a paper trail and human oversight. It's important that the machine be rigorously tested, to make sure it's counting correctly. This is where human judgement is critical: someone has to determine and define "correct" (do dimpled chads count? Hanging chads? Half-filled circles? Etc.). Once that definition has been accepted by involved parties, it becomes a matter of testing to ensure that the machine counts in that fashion. We need to make us of both advantages, judgemental ability and mechanistic consistency.

I also understand that machines do break, and designers can't predict all possible inputs. This limits the efficacy of the machines. Which is why I also advocate human oversight of the machine's results (i.e., have the machine print its interpretation of the ballot on the ballot, and have someone checking the ballots to make sure the intepretations are correct.)

By no means can we replace the human element of counting votes, but why make humans do something which they are singularly bad at when a far superior alternative exists?

***
"Oh, nothing. It just looks like a simple Kung-Fu Swedish Rastafarian Helldemon."
[ Parent ]

just asking out of curiosity (none / 0) (#31)
by nex on Fri Nov 08, 2002 at 10:16:34 AM EST

you think it is "very easy" to realiably count millions of loose slips of paper? you think electronic devices would not help with counting millions of things? you think it is efficient to stick them together with double sided sticky tape? you think extra measures should be adopted to verify the winner it it's a total landslide? or maybe you don't think that much at all?

[ Parent ]
It IS easy. (5.00 / 1) (#41)
by linca on Fri Nov 08, 2002 at 10:50:28 AM EST

Done with correct counting procedures, and enough participating citizens, it is very easy to count millions of "loose slips of paper" that are actually tucked by packs of one hundred in sealed enveloppes. Ever heard of distributed algorithms? Addition is a very powerful tool.

[ Parent ]
yes, but (none / 0) (#50)
by nex on Fri Nov 08, 2002 at 11:31:47 AM EST

my point wasn't that counting by hand is hard. see my reply to the comment below.

[ Parent ]
Yes, yes, yes, and yes (5.00 / 1) (#42)
by squigly on Fri Nov 08, 2002 at 10:55:14 AM EST

you think it is "very easy" to realiably count millions of loose slips of paper?

I do think its very easy to count a number of thick black marks in a row.  We do manage to count several million slips in England by hand every four years.  Numbers are not really elevent.  The more voters there are, the larger the pool of counters.  It scales linearly, except you have to add each counter's tally together.

you think electronic devices would not help with counting millions of things?

Depends on the device.  If its a punchcard device, then no, I think it's more of a hindrance than a help.  A simple optical mark reader will probably be more reliable.

you think it is efficient to stick them together with double sided sticky tape?  

Worked last time I did this. It was only a small school election (under the guidance of a member of the electoral committee) , but putting a strip of tape along a table and lining up the slips works very well.

you think extra measures should be adopted to verify the winner it it's a total landslide?

Yes.  We might as well.  It's comforting to get a human to verify this.

or maybe you don't think that much at all?

So, why do you think that its so hard to count several million slips of paper by hand?  What's

[ Parent ]

okay, okay, okay and okay (none / 0) (#48)
by nex on Fri Nov 08, 2002 at 11:25:24 AM EST

your statements are perfectly right, but missing the actuall point just a tiny little bit. you see, it may be simple to do a manual count, but that is no reason why it's ebtter than a slightly more complicated method that relies on electronics. it may be an easy job when it is divided among enough people, but that doesn't make it more easy to do a reliable count, hinder corruption etc. if something works fine, it doesn't mean that it's efficient. when you quoted my question about the landslide thing, you deleted my emphasis. you see, if you have measures to determine the winner, they'll generally be more reliable, because they allow for a greater error margin, the more of a landslide it is. so, extra measures that are specifically designed to determine the winner in the case of a total landslide are most definitely not needed.

and i didn't say i think counting several millions slips of paper was "so hard". i just didn't understand why you reccomend recommend hand counting. i didn't understand your arguments. they were so incomprehensible to me that i asked myself if i was holding the monitor upside down or something.

[ Parent ]

Thinking about it.... (none / 0) (#52)
by squigly on Fri Nov 08, 2002 at 11:49:09 AM EST

I agree that its probably better to use a machine if it is actually proveably as reliable or more so than hand counting.  I had not problem with machines marking multiple choice exam papers, and these were also fairly important.  Hand counting is actually reasonably accurate.

And I have no idea what I was on about when I suggested that we need to verify a landslide.  Sorry.  Sometimes I tend to express myself badly.  I still feel that sorting them into bins could be useful.  Verifying the counts manually would be a lot easier in this case, and we could also eliminate the losers.  Just count the two largest piles if it's extremely close, and if there's a landslide just get a few people to flick through the winner's ballots to check that they all have a mark in the same place.  

[ Parent ]

Corruption and paper ballots (5.00 / 2) (#56)
by linca on Fri Nov 08, 2002 at 12:23:07 PM EST

One advantage of paper ballots is that many people are required to count them. And the counting is easy to see. The corruption needs to be on a huge scale, something like a some hundred of thousand of people - every single ballot is seen by five or six people at least. Whereas someone skewing an hundred machines could turn the tide of an election.

The counting is quite reliable, the additions made afterwards very easy both to do and to check ; the results are published down to every counting bureau, and thus it is easy for me to check if what I counted is what is published. Since many parties are doing that checking, the results are very reliable.

The enormous plus of handcounting is its extreme openness. At all stages of the counting the ballots are visible. Changing the results is impossible if enough citizens - half a percent of the voters, at most - do their job and oversee the counting process. Whereas in most other methods, there are points where the ballots are out of sight, and where manipulations could (and often will) occur.

[ Parent ]

good points, and convincing (none / 0) (#67)
by nex on Fri Nov 08, 2002 at 01:06:44 PM EST

There are some advantages to paper ballots over electronic machines indeed. For example, in my polling station, 5/1050/1075 people have voted for the communist/people's/freedom party. Once the piles are sorted out, the votes for the communist party are trivial to count, and when I'm in the room where the votes are sorted and counted, I can be pretty sure that no one has thrown some of the away, because someone would have noticed. Later, I can verify that the number was correctly transmitted and added to the total. To be sure about the other piles, who have pretty much the same height, I have to count every ballot myself or trust the people who do it. If every slip is counted twice, each time from a member of a different party, I can be rpetty sure that the numbers are accurate.

When a machine records 50 votes for the people's party as votes for the freedom party, I can't tell. I have to trust the people who made the machine. While I could think of ways that would make it possible for every voter to anonymously check if his vote was accounted for correctly, these Ideas can't be realised as long as there are old people who don't know how to use computers; it would be too complicated for them. So we seem to be stuck with the problem that we can't trust the people who make the machines.

Maybe some clever person will save this problem in the future, but I guess you're right, paper ballots do have advantages that I didn't even think of before.

[ Parent ]

Transparency (3.83 / 6) (#18)
by Simon Kinahan on Fri Nov 08, 2002 at 05:52:15 AM EST

I agree that having a paper trail matters, so that any error or corruptions leaves a historical record that can be traced. The other thing that matters is that the process for voting and vote counting, with all its safeguards for anonymity and protections against corruption, be comprehensible to anyone of average intelligence. If it isn't, the uncertainty over the actual result this raises in the public mind can damage the legitimacy of the process.

Complex, technological systems, by their nature, have more ways to go wrong, and are comprehensible to fewer people. The results in a purely electronic voting system are only going to be readable by a small number of state officials, and since most people don't understand how they're stored, or what protects them against "hackers", they wouldn't entirely trust them even if they could see them. Even those punch cards that were used in Florida could be examined by newspapers after the event, not that it helped.


Simon

If you disagree, post, don't moderate

not wrong in principle, but oversimplifying (none / 0) (#34)
by nex on Fri Nov 08, 2002 at 10:27:45 AM EST

by saying that a paper trail is vital to exclude errors and curruption, you imply that everything written on paper is correct. this is just wrong.

you are also wrong in saying that paper ballots are easier to 'see'. the results of the count can always be accessed by exactly the same people, no matter how the count was done. if someone doesn't trust numbers he reads on a web site, why should he trust truckloads of paper that is locked away somewhere? even if you dumped the paper on his yard and he could 'see' the votes, he couldn't count them all alone.

people might really trust paper slips more, because they better understand the process and they have seen more computers crash and lose data when they were running buggy software or operated by incompetent people than they have seen paper slips burning. however, this impression is by no means objective.

[ Parent ]

Well ... (5.00 / 2) (#79)
by Simon Kinahan on Fri Nov 08, 2002 at 03:52:49 PM EST

by saying that a paper trail is vital to exclude errors and curruption, you imply that everything written on paper is correct. this is just wrong.

Much though I hate the term, I think you're setting up a straw-man here. With the simplest possible voting system (put an X in the box for your candidate), if you have the right piece of paper, what is on it is correct. It is necessary to have some system to establish that it is the right piece of paper. In the UK, this is done putting serial numbers on them.

if someone doesn't trust numbers he reads on a web site, why should he trust truckloads of paper that is locked away somewhere?

Because the ballots are counted by volunteers. The counting is monitored by non-partisan officials. The votes are recounted until the result comes out consistently one way or the other. There is no ambguity, because ballots without a single X in one and only one box are considered spoiled and not counted. If a computer does the counting, it is much harder to an ordinary person to establish that there was no skullduggery anywhere in the system.

If even the ambiguity inherent in whether a hole is punched or not can cause the amount of trouble we saw in Florida, imagine how much more trouble a crashed hard disk, or an off-by-one error could cause.

however, this impression is by no means objective.

But its perfectly objective. Even the best software has bugs in it. Even the most reliable hardware sometimes fails. A stack of bits of paper and a bunch of humans to count them is much less likely to fail. Any failure mode that can affect the lo-tech solution can also affect the hi-tech one, but the hi-tech one has many more.

The thing that really gets me is: almost all countries count votes by hand. OK, so the USA is very big, but if anything American citizens have a better civic ethic than average. If Brits can be persuaded to volunteer to count ballots, I'm sure Americans can. What the hell is the point in using complex, potentially unreliable, technology to do something for which total transparency is absolutely vital, and a lo-tech solution is perfectly adequate ?

Simon

If you disagree, post, don't moderate
[ Parent ]

current system not so hot... (3.75 / 4) (#19)
by mreardon on Fri Nov 08, 2002 at 06:54:37 AM EST

If there is a problem with the ballot, the machine spits it back out at the voter and the voter then has to take it to the desk where elections officials sit, have them certify it as "spoiled"
This does not tally with what happened in Florida. Why were there so many arguments about what is a chad and what is not if the machine just spat back anything it had a problem with.

As I understand it, the mechanical voting machines have different settings ( according to what I have read in The Best Democracy Money can Buy). They can be set to reject problem ballots but not notify the voter, as well as reject and notify. Of course, being a mechanical machine - I am sure that the mechanical paramaters of accept/reject must be manually configurable also.

So in areas where a party expects a predominantly negative vote the machines can be set to just be:

1)Be very picky about what is a readable ballot.

2)reject (and not notify) votes that would normally be spat back.

Oh and 3) Illegitimately erase 57000 voters from the register, who were not going to vote for you in the first place.

Punch cards vs. optical cards (none / 0) (#77)
by Eric Green on Fri Nov 08, 2002 at 02:52:15 PM EST

First of all, there were two predominant systems used in Florida in 2000: optically-scanned cards (basically fill-in-the-bubble cards as are used for the SAT) and punch cards. Only the punch cards had the chad problems. Secondly, regarding spitting the cards back out, the optically scanners on the ballot boxes in some districts were programmed to spit the ballot back if it was incorrect, and in other districts the ballot boxes accepted the cards without checking them. Greg Palast claims that this mismash was set up so that predominantly Republican districts got the good machines, and predominantly Democratic districts got the bad machines. This lack of uniformity, whether intentional or not, does mean that it's impossible to hold a fair vote. That's one reason why the state of Georgia this year adopted the touch-screen machines state-wide -- they figured at least they would be uniform state-wide and any undercounts would be consistent statewide. The problem is that they booted the optically scanned card systems out of many voting districts to do this -- thus my comment about the optical scanned system being replaced by the touch screen system, which, in my opinion, is less reliable (i.e., more broken machines at polling places) and more prone to losing votes.
--
You are feeling sleepy... you are feeling verrry sleepy...
[ Parent ]
touch screens (none / 0) (#103)
by mreardon on Mon Nov 11, 2002 at 05:14:36 AM EST

I agree it is not impossible to hold a fair vote. It all depends on the motives/actions of people in charge of the voting system.

Having used the ATM-type touch screens twice now. I am at a loss as to how they are less reliable or how they lose votes.

[ Parent ]

UGH (3.33 / 3) (#20)
by Craevenwulfe on Fri Nov 08, 2002 at 08:20:04 AM EST

Why would you use optical scanning whatsoever? You mention paper trails, since when did a shop use OCR on your receipt.

The most simplistic method is to use a computer terminal like any bank ATM to make the selections you wish and then have the machine print out your choice and increment in memory.

If the printed ticket varies from what you selected then you call error, if it doesn't it's happy.

In this way it's faster and simpler due to the fact that in this method work only has to be done IF there is an error. Whereas in the OCR method the error prevention method can produce errors.

A paper tape is still subject (4.50 / 2) (#26)
by porkchop_d_clown on Fri Nov 08, 2002 at 09:50:49 AM EST

to bugs or hacking of the machine itself. If the machines were built to the same standard as, say, the space shuttle, with redundant CPUs and software that's been vetted by teams of experts, I'd be okay with a paper tape, but the makers of the voting machines generally consider their software as proprietary and don't let outsiders audit it. Even if they did, I'd want to know about the safe guards to prevent a machine from being "chipped".


--
Once one sock is sucked, the other sock will remain forever unsucked.


[ Parent ]

Optical scanning (none / 0) (#32)
by wiredog on Fri Nov 08, 2002 at 10:17:28 AM EST

is not optical character recognition. Optical scanning in voting means you fill in the oval next to your candidate's name, the bond issue you're voting for/against, etc. The same technology that's been used for grading the SATs for decades.

More Math! Less Pr0n! K5 For K5ers!
--Rusty

[ Parent ]
Am I the only person at k5 (4.00 / 6) (#21)
by wiredog on Fri Nov 08, 2002 at 08:33:55 AM EST

who's actually worked for a political party during an election? There seems to be an assumption among most of the people here that the majority party has full control over how the ballots (paper, electronic, or whatever) are handled and counted. There are (at least in the US) election judges. At least two, from different parties (D and R here), who watch the balloting and the counting. It's very hard for the Dems to steal the election when the Reps are looking at everything, and vice versa. In an electronic system the programming of the machines is reviewed by both of the major parties, in electronic, mechanical, and paper systems the layout of the ballot is reviewed by both.

The Florida debacle was caused by a badly laid out ballot and the use of punch card ballots (although those never caused any trouble in Utah).

More Math! Less Pr0n! K5 For K5ers!
--Rusty

assumption (4.60 / 5) (#22)
by mreardon on Fri Nov 08, 2002 at 09:02:01 AM EST

It might be very hard (to steal the election), but it is not impossible

Also, the makers of the voting machines themselves might have conflicts of interest.

[ Parent ]

Assuming assumption (3.80 / 5) (#23)
by vitriol on Fri Nov 08, 2002 at 09:22:23 AM EST

There seems to be an assumption among most of the people here that the majority party has full control over how the ballots (paper, electronic, or whatever) are handled and counted.
I don't think that this assumption has to be made to see a problem (you're assuming an assumption). Besides, it's completely ridiculous to dismiss the potential problem of election fraud outright. Election law varies from state to state, your experience is not representative of the whole country. Can you honestly attest that there is no potential for abuse anywhere in the US?

Even ruling out the possibility of on party stealing the election you still have the problems of programmer error and system failure. With a punchcard ballot, if the count is botched (for whatever reason) you always have the paper records to go back to.

Why should our system of accounting votes be any less secure than a cash register? Eric is dead-on in this article.



[ Parent ]
Programming not reviewed.... (4.00 / 1) (#68)
by Eric Green on Fri Nov 08, 2002 at 01:07:02 PM EST

The voting machine companies that make these new touch-screen machines have stated that their programming is a proprietary trade secret, and prohibit representatives of the parties from looking at their actual programming.

My Aunt Beatrice is one of those polling place monitors, I think she's the one for the Democratic party in her precinct. I can assure you that she (an elderly lady in her 70's) has absolutely no idea how an electronic voting machine works. But paper... now that's something she can understand. Actually, in her precinct they were using the last of the old lever-type machines when I was there (several years ago). At the beginning of the vote, she certified that the wheels all showed zero. At the end of the voting day, she verified that the wheels showed what the elections department official certified in her book, and countersigned that affidavit. This is pretty much the extent of her technical abilities.

By far the vast majority of polling place monitors are volunteer retirees, because they're the only ones who have the spare time to spend all day monitoring the vote. Only in the most critical districts do the parties place paid professionals who have more than cursorary training in making sure that a vote is taking place without fraud. Asking a typical polling place monitor to understand high tech stuff is like asking a Neanderthal to fly an F-16 fighter jet -- it ain't happening. If someone comes in and claims to be from ES&S and spends time under the hood of one of the machines, she has no idea what he's doing under there -- and while she can certify the vote count displayed on the screen the same way that she can certify the vote count displayed by the wheels on the old mechanical machines, she has no way of knowing whether that count is actually accurate. For that matter, that's true of the old mechanical lever machines too -- they were fairly easy to doctor (by, e.g., filing off a cog on one of the counters, which could cause it to "skip" a vote for a particular candidate from time to time), which just goes to show that lack of an audit trail isn't just a problem with the new touch-screen machines.
--
You are feeling sleepy... you are feeling verrry sleepy...
[ Parent ]

Yes, he is right. (2.66 / 3) (#25)
by porkchop_d_clown on Fri Nov 08, 2002 at 09:48:28 AM EST

Given the impossibility of making perfect software able to handle all possible contingencies, an irrevocable paper trail is essential - and that trail must not be the result of a machine's interpretation of what the voter did.

The problem with punch cards is that the cards themselves are subject to alteration with repeated handling - hence all the problems with the recount in Florida. The solution is better punch cards, or a comparable technology, not to eliminate them.


--
Once one sock is sucked, the other sock will remain forever unsucked.


Voting Cards (none / 0) (#35)
by AndySocial on Fri Nov 08, 2002 at 10:32:15 AM EST

Punch cards fall apart with excessive handling, making recounts problematic.  BUT, the optically-read Scantron forms don't have that problem, as nothing is punched out of them, merely bubbles filled in by pen.  Using pens means no alterations after the fact, as opposed to the pencils we're used to on most scanned forms.

[ Parent ]
I mean, it's K5 for cryin' out loud! (1.25 / 8) (#27)
by Fon2d2 on Fri Nov 08, 2002 at 09:52:51 AM EST

Of COURSE there's anti Microsoft propaganda every fifteen minutes!

Two different problems being discussed (3.66 / 3) (#28)
by cod on Fri Nov 08, 2002 at 09:55:13 AM EST

I see two seperate issues getting mixed up here, correctly casting a vote versus correctly counting the vote. Correctly casting the vote is, always has been, and always should be the responsibility of the voter. Obviously, government should not be making the job harder with lousy user interfaces, flakey touch screens, etc. But ultimately it is the responsibility of the voter to make sure everything is correct BEFORE they push submit, pull the lever, drop the ballot in the box, whatever. Counting votes is a whole different issue. Completely digital systems certainly should be more accurate in counting than optical scanners, manual counts, punch cards, etc. The authors concern about an audit trail is valid, and today a paper receipt seems to me to be the most reliable audit trail. Although I could envision some sort of smart card system where you vote is recorded on a smart card and then you deposit that in the ballot box as the audit trail. In case of a discrepancy, the smart cards are run through a reader to verify the original count. Again, all digital data should be more reliable that a analog to digital conversion somewhere in the process. It seems that what is actually happening is that we are implementing systems that make the counting easier, but make it more difficult to cast the ballot correctly in the first place.

Voting Machines (3.00 / 1) (#33)
by Yeshi on Fri Nov 08, 2002 at 10:25:47 AM EST

I definitely think a checkup mechanism is missing.

Each voter should at least get a printed note with his ID number of sorts, by which he/she can (anonymously) check over the internet that his vote has been counted, and for whom he/she voted.

No other electronic data collection system works so flipsy/flimsy with enormously important data as this one. Is the design ommision deliberate or just the sign-of-(cheapo?)times?

hmmm..

I know as systems engineer that i'd never deliberately design such a thing - with the exception if my boss explicitly ordered me to do so....

This has drawbacks (4.50 / 2) (#39)
by NoBeardPete on Fri Nov 08, 2002 at 10:47:14 AM EST

This is a nice idea, but it has its drawbacks. This opens up a whole can of worms where people can be pressured into voting a certain way by their spouse, parent, or employer, and then pressured into proving that they voted the way they were "supposed" to. I think it's an important feature of the voting system that there is no way for someone else to find out for sure how you voted, even with your explicit help. That way you can still vote your concience, and not have to worry about being found out.


Arrr, it be the infamous pirate, No Beard Pete!
[ Parent ]

interesting (4.50 / 2) (#43)
by clark9000 on Fri Nov 08, 2002 at 10:59:45 AM EST

That's an interesting idea, ie, the ability to verify that your vote was correctly counted after the fact. However, suppose the voter didn't keep his id number secure, and somebody else got ahold of it? Then the vote wouldn't be anonymous.

Further, suppose some people wanted to change their vote based on the outcome of the election. For instance, for the last presidential election, maybe some Nader voters in Florida would have liked to have changed their votes if they had known that the race would be so close. With your system, they could have claimed that their vote was miscounted and that they wanted it changed. What to do in that case?
_____
Much madness is divinest sense
To a discerning eye;
Much sense the starkest madness.

-- E. Dickinson
[ Parent ]
Knowing your vote counted (5.00 / 1) (#55)
by Eric Green on Fri Nov 08, 2002 at 12:22:37 PM EST

That's another issue. I voted absentee this year. I faithfully filled out my ballot, put it into the envelope, signed the envelope as instructed, and mailed it to the Registrar of Voters. Did she get it? Was it counted? I have no idea.

Your notion of having the ballot box print out a slip is a reasonable one. This is a standard part of accounting for money in any kind of retail operation -- a slip telling what you bought, and what each item cost. In Brazil, this slip is then what is actually placed into the ballot box. The computer serves as a fancy printer in this case, and as a tabulating machine, but the actual ballot is the slip printed by the computer, not the records inside the computer's memory. But that still doesn't prove that your particular individual vote was counted. (Though obviously in Brazil it was, since Lula won).

Grocery stores of course give you the slip, and have their own copy of the slip. The problem that is typically brought up by voting officials is the problem of the New White Leagues (or whatever other group is wanting to force you to vote for their own candidate via intimidation or whatever) stopping you in the streets after you vote, demanding your slip, and killing you if you voted for the wrong person.

In short, given the need for anonymity and the need to hide who you voted for, making some sort of record that your vote was actually counted is a hard problem. The best I can come up with is if you are given a slip with the ballot box information on it, and you memorize your ballot number, and the data from the actual ballots is placed on the WWW somewhere. The White Leagues will have no proof that you voted a certain way -- but neither will you. You can at least go online and see how your ballot was counted, but if it was counted as a Bush vote when you voted for Gore, you still have no proof that you can use in a court of law to prove that you actually voted for Gore. A lawyer for Bush could claim that you're just a cretin and pressed the vote for Bush when you thought you were pressing the vote for Gore.

In short, anonymity vs. authentication is a hard one. It is relatively easy to authenticate that a particular ballot was cast in a certain box in a certain polling place and witnessed as such by representatives of the major parties and has not been tampered with. But it's much harder to authenticate that you, Joe Voter, had his vote actually counted, and counted for the right person -- and to do this in an anonymous fashion that does not open you up to retribution by the New White Leagues or any other violent group that wants to punish you if you vote "wrong".
--
You are feeling sleepy... you are feeling verrry sleepy...
[ Parent ]

also.... (none / 0) (#78)
by memfree on Fri Nov 08, 2002 at 03:03:02 PM EST

In addition to NoBeardPete's comments, which are dead-on accurate, an online verification system would likely be generated by the same company that wrote the software/database. Therefore, if someone was *intentionally* skewing the vote, they could retain actual records for reference purposes, but use their own, fake data when reporting.

On the plus side, surely someone would make a script to tally what each and every persons online vote so that it could be compared to the results the company reported. Now if there was some way to prevent vote-buying/bullying, too...any online confirmation of vote would have to exclude all personal identification data.

This neat article from Smithsonian Magazine covers some early voting problems.

[ Parent ]

somewhere in Florida... (4.16 / 6) (#36)
by crazycanuck on Fri Nov 08, 2002 at 10:39:49 AM EST

>WOULD YOU LIKE TO VOTE FOR BUSH?
No, I vote for Gore
>ARE YOU SURE YOU WISH TO VOTE FOR GORE?
Yes
>BUT I REALLY BELIEVE BUSH WOULD BE A BETTER CHOICE
No, vote for Gore
>I BELIEVE YOU ARE MAKING A MISTAKE. I WILL ENTER A VOTE FOR BUSH INSTEAD
Gore!
>I'M SORRY, I CAN'T DO THAT, DAVE

Windows bluescreens (4.00 / 2) (#38)
by AnalogBoy on Fri Nov 08, 2002 at 10:45:37 AM EST

Kvetching about windows blue screening is so 1998.  Get over it, it doesn't make you cool.  Modern windows versions blue screen rarely.   Something has to be damn wrong.   Applications hang. Yes.  Memory hog applications. Yep.  If you want to gripe about blue screens, go to that other place.

Otherwise I enjoyed your article.  But you lost credibility, and dare I say, votes - for that comment.  
--
Save the environment, plant a Bush back in Texas.
Religous Tolerance (And click a banner while you're there)

Windows and blue screens (none / 0) (#61)
by Eric Green on Fri Nov 08, 2002 at 12:41:32 PM EST

There have been widespread reports in this past election of voting machines that "froze up" or otherwise crashed due to problems with either Windows or the actual voting software. So while "blue screen of death" was obvious hyperbole (and I'll admit as much), the issue of software reliability is not a minor one. Perhaps I should have stated it in a more, uhm, diplomatic, manner... but what the [bleep], everybody knows I'm a Linux geek anyhow :-).
--
You are feeling sleepy... you are feeling verrry sleepy...
[ Parent ]
You contradict yourself! (3.66 / 3) (#40)
by Rogerborg on Fri Nov 08, 2002 at 10:48:51 AM EST

Touch screen is bad, the current system is good... except that it allows someone to lose or hide 100,000 votes until it's too late for a recount.

"Exterminate all rational thought." - W.S. Burroughs

Hiding votes (none / 0) (#59)
by Eric Green on Fri Nov 08, 2002 at 12:33:32 PM EST

First of all, assuring that all ballot boxes are accounted for is a different issue. It is one of elections procedures and making sure that these procedures have checks and balances that allow representatives of all parties with candidates in the election to supervise each stage of ballot box handling and account for the presence (or absence) of each ballot box. In the case in question, it is apparent that there was either gross incompetence on the part of the party representatives (i.e., they did not actually count the ballot boxes to make sure they were all there), or collusion on their part. If gross incompetence, electronic vs. paper doesn't matter -- either way, a ballot box (or voting machine total) can get "lost". If collusion, there is no voting method in the world that will help -- they will simply stuff the ballot box to say whatever they want it to say, whether it is an electronic one or otherwise. Do you seriously maintain that it mattered what voting technology was used when Iraqi citizens "voted" for Saddam Hussein last month?!
--
You are feeling sleepy... you are feeling verrry sleepy...
[ Parent ]
What the hell? (none / 0) (#74)
by Rogerborg on Fri Nov 08, 2002 at 01:40:19 PM EST

I disagree with you, therefore I'm with the terrorists?

Deal with this situation.  What does it matter if we can discover lost votes if we have no will to count them and change the result?  The system is already broken.  I fail to see how touch screens can possibly make it worse in fact rather than just in theory.

"Exterminate all rational thought." - W.S. Burroughs
[ Parent ]

Touch screens (none / 0) (#92)
by wumpus on Sat Nov 09, 2002 at 11:49:21 AM EST

If the touch screen does not create a human readable hardcopy (to place in ballot box) it can be corrupted with a few lines of code.

If both parties are willing to let elections become shell games (no ability to account for ballot boxes), touch screens can be assumed to give results planned ahead of time.

The difference is concentration of power. Since hiding votes requires that both parties allow rigged elections (at the top), then the software in touchscreens can also be rigged. The present system allows for precinct observers to insist on votes being counted.

Wumpus

[ Parent ]

"Can be", "allows for" (none / 0) (#99)
by Rogerborg on Sun Nov 10, 2002 at 07:44:44 AM EST

You didn't actually answer the question, I notice.

"Exterminate all rational thought." - W.S. Burroughs
[ Parent ]

Question answered. (none / 0) (#101)
by wumpus on Sun Nov 10, 2002 at 01:06:31 PM EST

I answered the question "How would touchscreens possibly make it worse?"

To steal an election under the current system, votes have to be "lost" under supervision of the hopefully vested intrests of those who need the votes. Also it requires large numbers of failures to account for votes to move the counted vote.

If you feel that it "could possibly" be as easy to reverse a landslide under these conditions than by changing a few lines of code, I can't help you.

If you wanted an answer for your bizare first question, ask Eric Green.

Wumpus

[ Parent ]

The companies that make these machines... (4.60 / 5) (#44)
by Count Zero on Fri Nov 08, 2002 at 11:06:08 AM EST

...are often owned by people who have a clear conflict of interest, up to, and including being actual politicians themselves.

The machines are complete trade secrets, no code has been audited, and there is no way to know if they do what they say they do. Note that these risks are not new, in fact comp.risks has talked about this for quite awhile.

Also, ES&S, one of the largest makers of voting machines, is threatening lawsuits against those that dare criticize them.


I like these ballots... (5.00 / 2) (#51)
by nytflyr on Fri Nov 08, 2002 at 11:32:28 AM EST

weve been using these as long as I can remember in Oklahoma, they are simple to understand, and simple to operate, there is no wrong way to incert the ballot inot the reader (except folding it in two or something stupid like that. And they leave a paper trail! sample ballots here: http://www.royalprintingco.com/html/ballots.html

yeah but the ballot access laws are shit (4.00 / 1) (#54)
by turmeric on Fri Nov 08, 2002 at 12:17:19 PM EST

oklahoma is one of the worst, the green party couldnt get on the ballot with tens of thousands of signatures, and there is no WRITE IN

[ Parent ]
Open Source (4.00 / 1) (#60)
by duffbeer703 on Fri Nov 08, 2002 at 12:38:06 PM EST

If we are going to have electronic voting, both the source code of the application and a public key of each build needs to be open to public review.

The lack of national voting standards is the real problem with voting in this country. Those standards don't exist because fair elections are not in the parties best interest.

Open source not panacea here (none / 0) (#64)
by Eric Green on Fri Nov 08, 2002 at 12:51:54 PM EST

The primary issue is the ease with which electronic data can be imperceptably changed on a hard drive. This issue remains whether the software is Open Source or Closed Source. While Open Source would remove the conflict of interest issues, it would do nothing to address the inherent reliability issues.

There are some who insist that the Closed Source voting software is of course "better" than the Open Source software due to "security by obscurity". I'll just note that back in my teaching days, I had no problem bypassing the security in my school's (closed source) school administration software and seeing (and possibly even *CHANGING*) data that I wasn't supposed to be able to access, such as students' discipline records (which I wanted to see because I wanted to know if little Johnny was giving other teachers as much trouble as he was giving me). Give me access to one of these closed-source voting machines, and I have little doubt that I could similarly track down where the votes are being stored and come up with a plan for altering the vote to be whatever I want it to be. Closed source as a security method is snake oil, pure and simple -- but Open Source won't solve the problem either.
--
You are feeling sleepy... you are feeling verrry sleepy...
[ Parent ]

I disagree. (none / 0) (#86)
by duffbeer703 on Fri Nov 08, 2002 at 11:00:05 PM EST

Run the voting system like a ledger.

Have a main journal with a record of each vote with a timestamp obtained via radio and a cryptographic hash of the timestamp and voter number to certify it.

Then have other "ledgers"... one for each candidate and one for incomplete votes.

Have the machines print a paper copy of each vote with it's associated hash and courier it to the election commission. Cross-match that with results uploaded with 45 minutes of the close of voting with a modem or other network access.

A secure system can be built. The problem is that the political system in general and democratic party in particular relies on our corrupt elections system. The loss of the political machines of the northest and the illegal alien vote of California would cripple the current party.

[ Parent ]

Use write-once media (none / 0) (#87)
by atsmyles on Fri Nov 08, 2002 at 11:04:01 PM EST

The primary issue is the ease with which electronic data can be imperceptably changed on a hard drive.

CD-ROM technology can easily solve this. I don't see how paper is more secure than electronic voting.

[ Parent ]
Touchscreen ballots have two major advantages (5.00 / 5) (#62)
by Adam Tarr on Fri Nov 08, 2002 at 12:44:36 PM EST

Let me start by saying that requiring touch-screen voting machines to produce a paper receipt, which would contain a summary of all your votes, is a good idea. You could even take it a step further and require by law that the machine produce TWO paper receipts: one that the voter keeps, and one that is kept in a lock-box inside the machine in the case that a manual recount is needed. Probably only a massive system crash or power surge would necesitate this, but it would be a good safe-guard. So there are solutions to the problem that don't involve getting rid of touch-screen ballots. You've raised a valid concern about the lack of verifiability of a touch-screen result, and I want to make absolutely clear that I do not debate that.

What I want to point out is that there are compelling reasons why the touchscreeen ballot machines are a big improvement, and should be kept. The first, and most obvious, is that it is much harder to vote incorrectly with a touch-screen ballot. Optical reader ballots are a step above manual ballots, in that the voter can verify that they didn't submit a spoiled ballot. But there is nothing in the nature of an optical ballot that keeps the voter from mistakenly casting a vote for the wrong candidate - and this is easier to do than most of us techno-savvy folks would admit. By contrast, it is comically easy to vote with a touch-screen. When you touch a candidate, that candidate is highlighted, and the rest of the candidates disappear. Then you touch something else to confirm or cancel your vote. Anyone who is literate and not legally blind is going to have a hard time messing up a touch-screen vote.

This sort of voter accuracy is a HUGE issue, and taking the intimidation out of the voting process could encourage a lot more people to vote.

The second reason I support moving over to touch-screen ballots is that they are far more amenable to alternative voting systems. Right now, the vast majority of elections in the United States are conducted using single-district, one-vote plurality voting. While such elections are simple to vote in, they have all sorts of theoretical problems that keep them from accurately representing the will of the people. The most well-known problem is probably the "spoiler effect," which is manifested in the USA when votes for the Green candidate allow the Republican to win, or votes for the Libertarian candidate allow the Democrat to win. For more details on various single-winner electoral system reforms, check out the election methods web site; for details on proportional representation and how it is a better solution for legislatures this site is a good start.

So, what does all of this have to do with touch-screen ballots? The answer is that some of these voting systems, which ask voters to rank candidates, can be a real bear to vote in with paper ballots. Cambridge, Massachusetts elects its city council using a ranked-ballot voting scheme, and their (optical) ballots are pretty massive. This may work in Cambridge, but will it play in Peoria? I doubt it. In Australia, where ranked balloting is quite common, over 95% of the voters just check a shortcut box that allows them to vote the "party line" in a pre-determined order. This sort of defeats the whole point of allowing voters to rank the candidates in the first place.

With touch-screen ballots, on the other hand, ranking candidates would be a cinch. More democratic, more proportional voting schemes become much more feasible when you have a touch screen and a slick user interface. This is a laudable goal. So for reasons of simplicity in the short run, and for the hope of more democratic voting systems in the long run, I applaud the introduction of touch-screen balloting machines.

-Adam

A receipt? (4.50 / 2) (#88)
by PurpleBob on Sat Nov 09, 2002 at 12:18:31 AM EST

Getting a receipt for voting is a terribly dumb idea. Think about it.

Political TV ads would be obsolete - the politicians could simply cut out the middleman and literally buy the votes.

[ Parent ]

Really. (none / 0) (#111)
by vectro on Fri Nov 29, 2002 at 02:22:23 PM EST

How is this different from voting by mail? You confirm the ballot is as desired, put it in the envelope, and seal it. You may not get a reciept, but it's still easy to confirm what the vote was.

Besides, buying votes is illegal and expensive. Much easier to bribe the voters from the public trough.

“The problem with that definition is just that it's bullshit.” -- localroger
[ Parent ]

Cryptogravoting? (5.00 / 4) (#65)
by fringd on Fri Nov 08, 2002 at 12:58:33 PM EST

I'm surprised nobody has mentioned cryptography yet. there was the weak mention of md5 sums, but i remembered and re-looked up some protocols from Applied Cryptography that deal with just this thing.

There is one system for example that uses one centralized tabulating facility, and has these six properties:

  1. Only authorized voters can vote
  2. No one can vote more than once.
  3. No one can determine for whom anyone else voted.
  4. No one can duplicate anyone else's vote.
  5. No one can change anyone else's vote without being discovered.
  6. Every voter can make sure that her vote has been taken into account in the final tabulation.
additionally this method has the following two extra features
  1. A voter can change his mind (retract his vote and make a new vote) within a certain amount of time.
  2. If a voter finds out that his vote is miscounted, he can identify and correct the problem without jeopardizing the secrecy of his ballot.

this post is already too long, the protocol is described in a full version of this post that i made a diary entry. read it it's kinda interesting.

some minor problems include that a corrupt CTF could allocate the votes of people who respond positively in step (2) but then do not send in votes. Another problem is that the ANDOS protocol is actually pretty god damned complex.

a more serious problem is that the CTF can neglect to count a vote. this can't be fixed easily. Alice claims that the CTF intentionally neglected to count her vote, but the CTF claims that the voter never voted. (if things are very anonymous, then it's difficult for the CTF to really tilt the scales this way, but it still sucks)

the book mentions some other protocols that split the duty of the CTF up into a group of bodies. these protocols are slightly improved in that the bad things that can be done to voters can only be done by all the CTF sub-groups conspiring against her. if one lone CTF sub-group misbehaves, then the others will know.

i think also that most of the algorithms behind these things are probably patented. but none the less, by paying some companies and doing some organization, (and praying that quantum computers don't become a reality) we could have practically error-proof voting.

Software can be foolproof (4.00 / 1) (#66)
by coljac on Fri Nov 08, 2002 at 01:01:08 PM EST

Software *can* be foolproof enough for voting, which is to say, it can be ten times more secure than paper votes could ever be. Just think of the stuff that software controls in our society - the floodgates of dams, the entire water supply, our electricity supply, the weapons systems of combat aircraft, nuclear reactors. It's just a matter of the right resources and dedication to quality control. How can you object, in principle, to the use of electronics and software to handling the simple transmission of a few bytes of data?

---
Whether or not life is discovered there I think Jupiter should be declared an enemy planet. - Jack Handey
Reliability, accounting, and hardware control. (4.00 / 1) (#72)
by Eric Green on Fri Nov 08, 2002 at 01:27:22 PM EST

I will point out that first of all, we are talking about accounting, not about control of hardware. Accounting is done via certain basic principles, one of which is that there must always be a paper trail in order to maintain the integrity of the accounting process. Reliability is an issue -- computers can be struck by lightning, programs can crash, etc. -- but accounting for electronic data fraud is an equally important issue here.

Regarding software reliability in hardware control applications, every SCADA (Systems Control And Data Acquisition) system I've ever encountered has both mechanical and electro-mechanical backups. Valves can be closed via an electro-mechanical emergency shutdown system if necessary, or if even that fails, by actually driving out to the wellhead and physically closing valves the old fashioned way (i.e., by hand). And yes, SCADA systems do fail (that's the business my brother is in, and he has regularly had to fly out to oil rigs to fix failed systems). All I am suggesting is that electronic voting needs the same electro-mechanical and mechanical backups as your typical SCADA system -- i.e., a paper audit trail, since we're talking about accounting.
--
You are feeling sleepy... you are feeling verrry sleepy...
[ Parent ]

So? (3.33 / 3) (#76)
by dipierro on Fri Nov 08, 2002 at 02:49:14 PM EST

Reliability is an issue -- computers can be struck by lightning, programs can crash, etc. -- but accounting for electronic data fraud is an equally important issue here.

Paper can be struck by lightning as well, and it can be forged, too.

On the other hand, it's much simpler to back up electronic data, and well designed systems can all but eliminate fraud...

For example what if every single vote was made public, as in you get a random number when you place your vote and then the list of random numbers and candidates voted for is placed on the internet. Anyone who wants to do a recount can do so by downloading the data. Anyone who wants to check his vote can do so by downloading the data. You can lie about your vote number if you don't want people to know your vote. About the only place for fraud is someone adding votes, and no paper system is going to be superior in that regard.



[ Parent ]
Voting is different (5.00 / 1) (#82)
by cameldrv on Fri Nov 08, 2002 at 07:15:06 PM EST

We may trust computers to control many important systems, but those systems have a different human dimension. When dealing with (say) a nuclear power plant, the programmer can safely be assumed to want the plant to work correctly. Furthermore, if there is a failure, this is generally known. If the plant melts down because software error, the programmer will be held to account. On the other hand, some programmers or operators in voting systems may not want the system to work correctly, and if this done correctly, no one is the wiser.

[ Parent ]
Weapons and nuclear reactors are different (none / 0) (#98)
by squigly on Sun Nov 10, 2002 at 06:29:00 AM EST

Hardware control systems aren't as reliable as you might expect.  Even the flight systems of combat aircraft can go wrong.  They just reset.  They are simply designed for low downtime.  I expect a nuclear reactor has a big red PANIC button, that just drops a ton of lead onto the reactor core without the need for software.  The point is that they have manual overrides.

But of course, vote counting software should be easy.  It's just an array of counters for the actual vote, but we do need some form of dealing with a power failure.  The hardware interface to the scanner is another matter, but still not too hard.  Since all votes are independent, there should be no problems other than (potentially) memory leaks.  These are just something that will have to be dealt with at the design stage.  

[ Parent ]

Voting systems (5.00 / 5) (#69)
by jd on Fri Nov 08, 2002 at 01:10:13 PM EST

To be secure, a voting system must necessarily meet the following criteria:

  • Vote tallies must be independently verifiable
  • The vote counted must be the vote cast
  • Where statistical sampling is used, the sample size and sampling technique must be adequate to reflect the actual votes cast
  • Ballot boxes (physical or electronic) must be tracable at all times in the election and be tamper-proof
  • One voter, one vote, no more and no less

So far, Oregon is frequently plagued with stories in the local press of block-voting by corporations in State and Federal elections. Florida, in the recent elections, just "found" another 10,000 or so votes. Inadequate numbers of machines meant not all voters actually got to vote at all. The chaos would have made it easy for any "opportunistic" election official to "improve" the ratios in favour of their candidate. All this, after the official claims just after the election suggested that this election went smoothly, with few problems.

I'd say tens of thousands of votes going missing would constitute a few tens of thousands of problems occuring, from the POV of those who cast them, even if they didn't affect the outcome.

My personal belief is that digital voting is possible, and can meet all the requirements, provided certain criteria were met:

  • Digital votes should be readable by -anyone-, at some random interval after being cast. This would make electoral fraud much harder, as you couldn't just tamper with a machine or a ballot box. It would be visible to too many people, and be too easily traced.
  • There should be adequate machines for every single registered person to vote, plus 10%. (The 10% is to allow for machine failures, and other technical problems.)
  • The voter should be able to verify a vote, prior to it being "final", and should be able to verify it again, in an independent form, by means independent of the original machine, prior to it being placed in a physical or electronic ballot box.
  • ALL machines, ALL network connections, ALL power supplies, should have redundant connections. Power outages and net failures simply should not occur. If Joe Bloggs can buy a power backup for their home PC, your local Government can do the same for their voting systems. No excuses.
  • Administration of elections should be bipartisan. In other words, if the guys running the election have a vested interest in a specific result, you're much less likely to see the opposite result, no matter what public opinion might say.
  • Votes should be digitally signed by the voting station, at the very least, to prove that the vote remained unchanged between the time of being cast to the time of being counted.

All of these requirements could be met, easily. They won't be, precicely because nobody in power has an interest in improving ways to be ousted. They may be ignorant, but they're not stupid.

Vested interest (5.00 / 1) (#73)
by Eric Green on Fri Nov 08, 2002 at 01:36:59 PM EST

"All of these requirements could be met, easily. They won't be, precicely because nobody in power has an interest in improving ways to be ousted. They may be ignorant, but they're not stupid."

It reminds me of the aftermath of the Voting Rights Act of 1965. Both the Republicans and the Democrats in the South conspired during the 1966 elections to suppress the black vote, via "Voter Integrity" campaigns, dispatching the local cops on "nigger-knocking" expeditions on voting night, etc. In many cases these officials were not themselves particularly racist. They just had no idea who would win in a fair election. Uncertainty is something that elections officials are not fond of. After all, their whole point is to produce plausible certainty as to who was actually elected.

I suspect that improvements in the auditability of elections are exactly what these officials don't want, but for a different reason than you. Right now, they can shut their eyes and pretend the vote was fair, and hide any evidence of vote lossage ("spoilage") or potential fraud. It's not a perfect system, but it allows them to avoid the uncertainty that would result if voting fraud were actually being detected and allows them to avoid the lawsuits that would result. I do not personally believe that voting officials going for the new touch screen machines are corrupt, or are conspiring to "fix" elections. Rather, they're trying to make their own job easier -- by making any vote tampering undetectable, so that they can avoid having to deal with the aftermath of any vote tampering (i.e., recounts, lawsuits, the uncertainty as to who actually won, etc.).
--
You are feeling sleepy... you are feeling verrry sleepy...
[ Parent ]

Hmm. (none / 0) (#109)
by jd on Fri Nov 15, 2002 at 12:18:55 PM EST

Yeah, I can see that.

[ Parent ]
This should be a non-issue (4.66 / 3) (#80)
by GreenCrackBaby on Fri Nov 08, 2002 at 05:25:31 PM EST

A vote should be a binary notion; a yes or a no. The hanging chad fiasco from Florida simply shows that when humans are involved, the binary ideal of a vote becomes a bit more fuzzy.

A simple solution is to have a machine convert a human's vote into a true binary vote. A machine isn't going to fill in a box with a check mark when it should be using an "X".

Imagine this scenario, if you will:
A voter steps up to the voting machine. Displayed on the screen are all the names that the user can vote for.
1.) Person A
2.) Person B
3.) Person C
The voter interacts with the machine (pushes on the screen, pushes a button, .... whatever) to indicate "Person B".

The machine displays the message: "You have chosen 'Person B', is this correct?

The user can push on the screen/button/whathaveyou to indicate that this is, in fact, their vote. If they answer no, they are brought back to the choices on whom to vote for. If they answer yes, the machine incriments, by 1, the number of votes for person B and prints out a card with an "X" by person B's name.

Should a recount be necessary, optical scanners can be used to quickly read over the cards, as they have all been created by a machine without room for error.

...This whole thing just should be a non-issue!

I used Georgia's new voting system. (5.00 / 3) (#81)
by acronos on Fri Nov 08, 2002 at 05:31:21 PM EST

I used Georgia's new voting system, and I don't think your criticisms apply.  There is a paper trail logged inside the machine.  There is an encrypted flash card that is given to you when you sign in showing your license.  The machine logs your votes on that card and the card is placed in a ballet box after you finish.  The machine also keeps the votes tallied in an internal flash memory as well.  

So, there are three completely different ways to conduct a recount.  You can check the paper log.  You can re-tally the encrypted flash card.  Last, you can check the count recorded in each individual machine.  The machines were similar to a cash register printing out a paper receipt for problem situations but reporting electronically.  

I found the interface very easy to use.  It was much easier for me to understand than the paper ballets I've used before.  My only complaint was that many people probably had trouble knowing where to insert the encrypted card, and the card required significant force to slide into place.  While this probably confused a few voters, it only required asking one of the five people standing near the voting machines to rectify.  In the 20 minutes I was in the room I watched about 15 people vote and I didn't see anyone have to ask any questions.  

Personally, I really like the new systems.  I feel confident that my vote was secure, private, and accurate.  I disagree with the articles conclusions mostly because of factual errors in how the voting machines worked.  I'm really surprised that I haven't seen anyone else correcting these errors.  The machines DID have a paper trail.  They left a audit trail that was vastly superior to anything that could be done with paper ballets.


paper trail (4.00 / 1) (#93)
by fr2ty on Sat Nov 09, 2002 at 07:39:09 PM EST


there was a paper trail inside the box that you could actually see while it was logging your vote in a way that can't be misinterpreted?

i wonder how the log format looks like.  
--
Please note that are neither capitals nor numbers in my mail adress.
[ Parent ]

paper trail (none / 0) (#107)
by Rich0 on Tue Nov 12, 2002 at 12:17:55 AM EST

While I can't vouch for what kind of machine the comment in question was referring to, I do believe that there are machines out there which have a paper log which passes behind a clear plastic window of some sort, which allows the voter to see what exactly ends up on the log.

I think this is by far the best approach - you have the instant electronic tally, but you also have the ability to recount by optical scanning, or even by hand.

I think that the vote should be tallied and reported elecronically, and then around 1% of the precints should be automatically recounted by hand / optical scanner at random.  That would discourage messing with the electronic tally.

Alas, my precint uses touch-screen voting.  It is probably fair - the local election went to the party not in power...

[ Parent ]

What needs to happen, and now (4.25 / 4) (#83)
by localroger on Fri Nov 08, 2002 at 07:27:19 PM EST

Someone needs to acquire one of these ES&S machines -- STEAL it if necessary(*) -- and reverse-assemble the damn thing.

If the machine is honest, we can announce the result and pat the manufacturer on the back and ask what the fucking steel rod is doing up their ass.

But that won't happen. They have a steel rod up their ass about the code for a reason. Or maybe it really was a coincidence that all the surprises in this election favored the party with whom the major machine manufacturers are in bed.

(*) Not that I'd ever do such a thing, you understand, but if somebody else *cough* were to *cough* do so I could probably be persuaded to do the analysis. Very easily.

I can haz blog!

Open source voting machines (4.00 / 1) (#85)
by Ming D. Merciless on Fri Nov 08, 2002 at 09:57:58 PM EST

Yes! This is an excellent idea. Better yet, would be a machine that is designed in the open source manner -- both hardware and software.


[ Parent ]
Code has perceived value (5.00 / 1) (#95)
by squigly on Sun Nov 10, 2002 at 06:06:22 AM EST

They have a steel rod up their ass about the code for a reason.

It could just be RMS's old argument that the software industry is a service industry that thinks its in mass productions.

These companies seem to believe that the value of software is the amount it cost to produce and that giving someone a copy of the code will halve its value.  To support this argument, they point out that other succesful software companies like Microsoft don't rlease their code.  

This is just a guess.  It's hard to beleive that they can be this illogical, but it's a possible explanation.

But even if the code is totally open, how do we know that that's the code they used?  The executrable installed might be totally different code.  Should we demand an interpreted language with a publically available interpreter (e.g. Perl or Basic)?

[ Parent ]

No, there's another possible reason (4.00 / 1) (#96)
by squigly on Sun Nov 10, 2002 at 06:24:45 AM EST

Didn't consider this when I wrote that comment.  "Security through obscurity".  Also generally against any decent view of security, so not a valid reason.  

[ Parent ]
Knowing (5.00 / 1) (#100)
by localroger on Sun Nov 10, 2002 at 07:50:35 AM EST

But even if the code is totally open, how do we know that that's the code they used?

Good question. Industries that give a crap work this out. For example, if you go to Las Vegas and hit a fairly large jackpot, before they give you a check the nice man in the suit will bring out a slot tech. They will open the slot machine while the video cameras tape everything, and they will stick the EPROMs in a comparator to make sure they contain the same program as the benchmark chips supplied to the casino by the manufacturer.

Nevada also requires all slot machine code to be submitted to the state and approved before it can be used in a live gambling environment. The reason they do this is because it is so tempting to cheat, so much money is at stake, and so on. It's really not that difficult either to implement or to understand.

I can haz blog!
[ Parent ]

erm.. (none / 0) (#105)
by Yeshi on Mon Nov 11, 2002 at 10:59:45 AM EST

it is maybe not even the terminal machines that are able/manipulate the data, but it might happen in some repository later on on the way;

What is really needed is a feedback system that ties the verifiability of the end-result with the generating instance: in this case a voter herself.

[ Parent ]
Old style lever machines (3.33 / 3) (#84)
by Ming D. Merciless on Fri Nov 08, 2002 at 09:55:51 PM EST

Here where I live in rural upstate NY, our polling places still have the old mechanical machines where you pull a small lever down underneath the candidate's name. All the candidates for the same office (or choices in the case of propositions) are on the same row and all the candidates from one party are in the same column.

When you enter the voting booth, you pull a large rod from right to left which closes the privacy curtain behind you and sets the machine.

To vote, you pull down a lever for one candidate. You can not pull down the lever for another candidate for the same office unless you push up the first lever. You do not have to pull a lever in every row (thus allowing you not to vote for a specific office or proposition).

To cast your vote, you pull the large rod back, from left to right which reads your votes, resets the machine and opens the privacy curtain. The attendant can see that your votes have been cast because a counter advances on the rear of the machine (she does not see your votes, just that the number of voters has incremented).

IMHO, in spite of all modern alternatives these old mechanical machines remain superior. The user interface is excellent and the machines are sealed by the board of elections prior to the election and certified by the elections commissioner. It is easy to tell if the machine has been tampered with. These machines have been working infallibly for at least the 20 years or so I have been voting, and most of the years that my parents have been voting before me. I have heard of machines jamming before, however in that case voters can either be redirected to another polling place or a spare machine can be set up quickly.

I must say I was not aware that a recount could not be done with these machines -- that the tallies were zeroed out when read. It was my impression that the machine's tallies were fixed until reset. The votes were read off cylinders inside the machines and until someone at the board of elections reset them, the numbers did not change. However, I am not an expert in these devices, although it now occurs to me that it might be a good idea to seek out more knowledge on exactly how these machines work.

Even if the machines can not be used to give a recount, I still feel much more confident that my vote will be cast for the person I pulled the lever for than with any electronic voting machine. That is not to say I disagree with the author's main assertion of requiring a paper trail.

voting (4.33 / 3) (#89)
by kpeerless on Sat Nov 09, 2002 at 02:20:12 AM EST

One paper ballot One pencil Mark an X Put it in the box Election officials count it in front of the various parteis' scrutineers. We do it in Canada and count the whole country in a few hours. No software, chads or any other assorted bullshit. Works like a charm. More complicated than that and it is just an excuse to steal the election, as our friends south of the 49th should know by now. www.newsfromtheedge.org

I don't think you understand (none / 0) (#104)
by Nexus7 on Mon Nov 11, 2002 at 10:24:17 AM EST

Canada is a democracy. Obviously the voting process will be different.

[ Parent ]
It's all irrelevant. (4.50 / 4) (#90)
by opendna on Sat Nov 09, 2002 at 04:08:58 AM EST

From the city where "you can't even vote for the guy you don't want to vote for": San Francisco.

In in 2001 ballot boxes were found floating in the San Francisco Bay, the voting machines themselves kept a couple hundred more. This year over a hundred polling places ran out of ballots in San Francisco and the only city that DIDN'T have trouble used the electronic machines the above article is criticizing (SF Chronicle, 11/5/02).

I'm all for tickertape printouts or something, but let's not pretent the current system is *less* prone to abuse.

On a related note: I have never seen a "party representative" in the US, nevermind more than one trained poll clerk. Most of the time we've got four or five retirees, one of whom has gone through some sort of training. The sort of command and control the above article suggests exists with the current system is largely legislative fantasy, IMHO.



Ah computers! The solution to world hunger... not. (3.00 / 2) (#91)
by Tezcatlipoca on Sat Nov 09, 2002 at 05:59:45 AM EST

Once upon a time, in a country whose name escapes my frail memory, there was an election.

The candidate of the opossition for the presidency, a guy most liked by most, was clearly putting a very credible campaign and everybody was hopeful he will win and this way unsit a party of nasties that had the unpoliteness to govern for several decades suppresing real democracy (intimidation, censorship, beatings, illegal jailings, the full monty).

The election day came, the opostion candidate (by unconfirmed, underground, unnoficial accounts) was winning in most districts. At around mindnight all went pumpkin-shaped: the central computer system collapsed, many minutes transcurred, the system came back, and oh miracle! The official candidate was ahead and won the election (with 51% of the vote just to make sure).

A few years later, the paper trail was all burned almost in secret, that big was the shame.

Fast forward: the election body is now formed by independent citizens, the ballot boxes used are all transparent and although computers are used they only serve to concentrate voting in a speedy manner but the final counting is carried out with paper documents.

The election is clean, democracy gets a hold, and the opposition candidate won.

The moral? I don't know. Screw computers I guess. Specially if nobody has access to the server room....

Now let me ask: do you have access to the server room? To the code? WHo has access? D you trust them?

DOn;t put all your faith in computers, if people don't have the will to run a clean election and most importantly, if not enough poeple are willing to be involved in the political process (at least getting informed) then not even Deep Blue in each voting station will solve the problems of a flawed voting system.

Now tell me: who got most votes? AG or GBv2.0

European? Say no to software patents.

Puzzled Brit (4.00 / 1) (#94)
by dollyknot on Sat Nov 09, 2002 at 09:04:10 PM EST

Seeing how federal issues, like which President America has, are decided on a state by state voting process, surely that voting process should be standardised. It seems ludicrous that each state has its own voting process and this by a nation that supposedly put a man on the moon. It seems to me that this is a federal issue, not a state issue. The fact that the American electoral system can have an effect on the whole world worries me. One nutter in the white house could end up setting the world ablaze

Justice must not just be done, it must be seen to be done, in other words, in an open and accountable way. That buisness in Florida, worried me and I live thousands of miles away.

Peter
They call it an elephant's trunk, whereas it is in fact an elephant's nose - a nose by any other name would smell as sweetly.

Here's Why (4.00 / 1) (#106)
by Juppon Gatana on Mon Nov 11, 2002 at 05:57:27 PM EST

I agree with you and I believe the vast majority of Americans would be pleased with electoral reform; we want a system that works on a purely popular basis. But that isn't likely to happen. Here are the most straightforward reasons (surely there are others):

  • The original intention of the Founders was to create a check on federal power by empowering electors to stop voters from electing unacceptable candidates to the Presidency. "Unacceptable" here is with respect to the political elites at Constitutional Convention. In the same vein, elected state legislatures were responsible for selecting two Senate members for their states, not the voters. Because of this, the electoral college system (and with it the ability of individual states to run their own elections with a large amount of freedom) is written into the Constitution. This right of the states has been used largely for evil in the past, such as disenfranchising blacks and sometimes poor whites, but it remains written into our law of the land.
  • Amending the Constitution is an extremely difficult process that requires widespread support among politicians. Two-thirds of both houses of Congress must approve an amendment, and it then must be approved by three-fourths of the fifty state legislatures to go into effect. This process requires an intense and broad political backing for success.
  • Current politicians have little desire to reform the system that elected them. That should be fairly self-explanatory.
  • Many American voters (yes, even after Florida) are unaware of how the voting system works exactly, and so feel unwilling to demand reform. I, and almost everybody I know with a comprehensive understanding of American electoral politics, thinks our current system is totally absurd, but it is not so broken as to be a priority for reform among politicians.

There are more reasons, but those are the most obvious ones that come to mind. The American political system is by far the most encumbered Democracy in the developed world, and it makes any type of reform extremely difficult when compared to European parliamentary systems. Hope that helps!

- Juppon Gatana
能ある鷹は爪を隠す。
(Nou aru taka wa tsume wo kakusu.)
[ Parent ]
use for Palladium? (3.00 / 1) (#97)
by squidinkcalligraphy on Sun Nov 10, 2002 at 06:27:09 AM EST

Much as I am generally against the concept of Digital Rights Management, this is an example where it could be used usefully. They talk about being able to track and control a piece of information anywhere through its path from A to B... this is exactly what would be needed. Any tampering along the way would be evident. Thought I hate to say it, perhaps this is where Palladium could come in handy.
An identity card is better that no identity at all
Insufficient. (none / 0) (#108)
by cduffy on Tue Nov 12, 2002 at 11:31:11 PM EST

I actually did some work on an online voting system, (as in, saw one through to actual deployment in electing the officers of an $11 million corporation) and know of what I speak:

You can't trust the client.

You can never trust the client.

Paladium and such won't fix this, simply because they trust the client to be self-regulating, and can be defeated by a sufficiently motivated opponent. I don't want to go into exactly why all the strong-crypto-based voting systems out there are flawed on k5 right now, so I won't -- if you want that discussion and care to meet me in person in the Austin area, drop me an email -- but suffice to say that it's so.

Since you can't trust the client, and the user can't watch the electrons be stored on the drive (or, worse, sent over the network), electronic voting is extremely fraud-prone unless there's an actual paper token that can be inspected by the voter and which serves as the authoritative means of determining how that vote. Applying DRM doesn't attack the problem of relying on the client (in this case, the voting hardware) -- in fact, it's counterproductive, by just trusting the client more (to regulate itself).

Authenticating the data path all the way from the touchscreen won't help, because the touchscreen hardware can still be rewired to provide false data (while, say, routing the real data into a separate system providing false visual feedback). It's not a cheap attack, certainly, but it also wouldn't be the most expensive or difficult thing ever done to sway an election.

Palladium won't help. Electronic election systems without physical, human-readable tokens are broken, and always will be.

[ Parent ]

Why Shuffle? (4.00 / 1) (#102)
by anansi on Sun Nov 10, 2002 at 06:34:11 PM EST

I was a polling inspector for the general election, and we used the optical ballot scan. At the end of the day, I bring the scanning box to a phone jack and modem in the results to the county headquarters. We don't shuffle the ballots before giving them to voters, though...

The elections department has a list of which ballot cards are sent to which polling site. Representatives of each party at the polling site shuffle the ballots to randomly number them.

What additional security does this measure enable? It makes a sort of intuitive sense, but I'm not devious enough to figure out the cheat that this prevents...

Don't call it Fascism. Use Musollini's term: "Corporatism"

Paper trail can be understand by almost everyone (none / 0) (#110)
by fredz on Tue Nov 19, 2002 at 01:55:20 PM EST

One big advantage of a paper trail that I haven't seen mentioned is that it is understood by almost everybody. Non-technical people can understand the checks that occur in the process and judge the legitimacy of an election for themselves.

We have a long history of elections, with institutions like election observers to protect against ballot stuffing, recounts to protect against miscounts and so on. Very close elections like the one in Florida are sometimes questioned, but even in Florida almost everyone trusts that the results are within a few percent of being correct.

This trust is actually strengthened by the problems we saw in Florida - people read about hanging chads, and they can understand what happened. Some of us may feel that the Republicans used dirty tricks to clinch a very tight election, but even Republican-bashers like me believe that the election was very close. If I were to claim that Republican election officials had taken tens of thousands of ballots voting for Gore, added a punch for Buchanan to each of them, and turned a bunch of Gore votes into no-counts people could judge the accuracy of my claim: Did Republicans have un-observed control of the ballots, did they have enough time to tamper with that many ballots, .... Most people who care even slightly about the election are able to get at good idea of the likelihood that it was fixed.

Touch screen ballots eliminate mis-marking problems like hanging chad and double punches, but open the doors to wide spread suspicion of large scale election fraud. If the election is 100% honest, the winning candidate gets 80% of the votes, and I falsely claim that someone tweaked the display on a touch screen, or that someone tweaked the touch screen software randomly switching 5% of Democratic votes to Republican votes, or any of a thousand other possible technical exploits, very few people can judge the validity of my claim. How is the typical nurse, lawyer, truck driver, school teacher ... going to be able to judge if I am a crackpot or if I am right. It is going to come down to "the experts say he can't be right," but people will have very little basis on which to decide if they trust the experts.

Optically scanned ballots keep most of the traditional, commonly understood, verification methods that people can judge for themselves. Not only is there an audit trail, but it is a trail that most people can understand. Everything new in the process can be verified after the election by methods that people understand. Problems analogous to hanging chads or double punches could occur, but these could be checked by a scanner at the polling place that pops up a screen saying "You voted for ....."

Electronic voting machines are a terrible idea | 112 comments (107 topical, 5 editorial, 0 hidden)
Display: Sort:

kuro5hin.org

[XML]
All trademarks and copyrights on this page are owned by their respective companies. The Rest © 2000 - Present Kuro5hin.org Inc.
See our legalese page for copyright policies. Please also read our Privacy Policy.
Kuro5hin.org is powered by Free Software, including Apache, Perl, and Linux, The Scoop Engine that runs this site is freely available, under the terms of the GPL.
Need some help? Email help@kuro5hin.org.
My heart's the long stairs.

Powered by Scoop create account | help/FAQ | mission | links | search | IRC | YOU choose the stories!