Comments on Testimony by League of Women
Voters President Kay Maxwell before the Election Assistance Commission, May 5,
2004.
We the undersigned LWV members agree
with President Maxwell that concerns about electronic voting must be dealt with through
real-world safeguards that ensure Americans that their votes will, in fact, be
protected. We also share her concern
that the DRE debate not scare voters away from the polls.
However, ignoring or underestimating the very
serious accuracy and security risks of paperless DREs is not a solution. Instead, the LWV must address those risks
directly and responsibly. That is the
only way that we can, as President Maxwell says, “ensure that every vote will
count.”
Because Maxwell’s statement is very long, we
address only those points with which we differ most strongly. Quotes from Maxwell’s statement are
indented; our responses are not.
To tamper with a DRE someone would need to know
each of the security systems within the machine, including codes, formats and
storage capacities, and be able to manipulate them undetected after first
gaining sufficient access to spend the necessary time with the machine.
It
is technically wrong to claim that one would need to know each of the security
systems within a DRE in order to tamper with the machine. In fact, it is easy to write code that
changes the voting information on the touch screen before that information is
stored in the computer. If the vote has
been modified, it doesn’t matter how it is subsequently stored or what format
is used to store it. It is still
modified, and will not accurately reflect the will of the voter.
The
statement also ignores the very real possibility that errors (bugs) in the
software will cause the vote to be modified before the now incorrect version is
stored. We note that testing and certification done on DREs is totally
inadequate, as demonstrated by numerous failures of “certified” DREs in recent
elections.
Under HAVA, there must be a paper record of each vote from a DRE voting
system. In well-run systems, the printouts with vote totals are taken
throughout Election Day and compared to the total number of votes cast at the
machine, to ensure security. The paper records then provide a backup for
official tabulations of election results.
In most elections using DREs the paper printouts
are produced at the end of the day.
Unless a machine has a major failure, the paper printouts will match the
DRE counts. The paper reflects only
what is inside the machine. If the
information in the machine is incorrect, either because of bugs or malicious
code, the paper printouts will be equally incorrect. It is misleading to refer to such a paper printout as an audit.
The only way that any paper printout can be
trusted is if the voter has had an opportunity to check that it correctly
reflects his or her choices. Printing
out ballot images at the end of the election, or even during the election, is
simply a regurgitation of what is in the machine – not an audit check.
A VVPT is an add-on system that prints out the
voter’s individual ballot choices after they have been cast on the DRE…. The
term is used interchangeably to refer to systems that simply provide the
individual paper record for the voter to look at if she or he wishes, and
systems that would require that each voter actually verify the paper record of
his or her vote.
Maxwell’s definition, given above, of a voter-verified paper trail (VVPT) completely ignores the fact that optical scan voting machines, as well as other machines discussed below, create a voter-verified paper ballot. Furthermore, there are no DRE based systems using VVPT that require the voter to actually verify the paper record of his or her vote.
For the VVPT system to work as a backup for counting the vote
accurately, it seems that every voter must verify every ballot. Otherwise there
is no assurance that the paper trail is accurate. Unverified pieces of paper
don’t add accuracy or security. They may, or may not, reflect the voter’s
intent.
Ironically, Maxwell’s complaint about paper
ballots applies much more directly to paperless DREs. It would be very easy for a machine to display one thing on the
screen and store a different result internally. In that case there is no chance that the voter could catch the
cheat, because the voter could not see how his or her ballot is being stored
internally. However, if a reasonable
percentage of voters verify their paper ballots, then it’s likely that
cheating would be detected.
Maxwell refers to the ballot counting problems
from Florida 2000 and asks, somewhat rhetorically:
With these well-known problems with paper recounts, is it more likely
that the paper recount would be in error than the electronically cast ballots
from DREs?
This is a meaningless question, since there is
no way to determine if the ballot tallies stored in the DREs accurately reflect
the collective will of the voters.
By contrast, we are capable of accurately
counting paper. Banks do it all the
time. Other countries such as Canada
and the UK hold paper based elections and accurately count the ballots. There were many problems with Florida 2000,
but it is incorrect to infer from that experience that it’s not possible to
count paper ballots.
Maxwell’s entire discussion of VVPT ignores
optical scan paper ballots. Since the
computer-based machine used to tabulate optical scan ballots might also have
problems or be manipulated, a certain percentage of optical scan or other VVPT
ballots should be recounted manually.
California law mandates a 1% manual recount. If the recount does not match the machine count, then all of the
ballots should be manually counted.
First, if a malicious programmer or an outside “hacker” can change the
electronic record of the vote, certainly such a skilled person can make the
printer provide a paper record that doesn’t expose any error. In other words, if I vote for candidate A,
but the malicious programmer makes it so the electronic record says candidate
B, the programmer could also make the paper record for candidate A. Under this scenario, the voter and the poll
worker are not alerted to the problem. So, in this example, the paper record
does not indicate a problem with the machine, and does not provide a safeguard.
While factually correct, Maxwell’s statement
ignores the fact that some percentage of voter-verified ballots should be
manually counted, as we have discussed above.
The following statement by Maxwell raises a
legitimate concern and exposes the fundamental problem with all DREs, even
those with voter verified paper ballots:
Second, what happens if nine voters choose not to look at their paper
record, but the tenth voter reports that her or his paper record is wrong? Should
we assume that the previous nine votes were also wrong? Do we need to call those voters back and ask
them? Do we need to somehow retrieve their votes from the system? Under the
optional verification system, we clearly cannot rely on those unverified pieces
of paper for a later recount.
Those who do not verify their paper ballot risk
that their votes will be incorrectly counted. Obviously, a protocol must be
developed to take action when a voter claims an incorrect paper ballot. The
task is achievable, but this is not the place to do it.
We note that a DRE with no voter verified paper
ballot might be faulty, but no one would know and the incorrect tabulation
would be assumed to be correct.
We agree with Maxwell that standards are needed
for machines that produce voter verified paper ballots. DREs were rushed to market with grossly
inadequate standards, poor security, and testing that was so shoddy that it
didn’t even uncover rudimentary security problems. We should not repeat that mistake. The State of California is currently working on developing
standards for VVPT machines. Congress
should also provide funding for NIST so that they can develop meaningful
national standards for voting machines.
Finally, we are concerned that the VVPT system can reduce access for
persons with disabilities, limited English proficiency and low literacy. The
VVPT system provides for the voter to verify the paper ballot, which
historically disenfranchised voters will find difficult to do if they cannot
see or if they have difficulty reading the paper verification. Private and independent voting is important,
and, at this juncture, seems inconsistent with the VVPT system for significant
numbers of voters.
The US Department of Justice disagrees. In an opinion dated Oct. 10, 2003, the DoJ determined that a VVPT system does not discriminate against people with disabilities. Furthermore, all voters would benefit from having some voters verify their ballots as a check against software bugs and fraud.
Furthermore,
it is technically possible to have voter verified paper ballots that can be
verified by people with vision problems, limited English proficiency, and low
literacy.
For
example, a machine has been developed (Vogue Election Systems) that can be used
by people with vision and language problems just as they would use a DRE. Instead of tabulating and counting the
votes, the VES machine marks an optical scan ballot. That ballot can be read through an optical scanner with attached
earphones and verified by the blind. It
can also be verified by the sighted and counted, both by an optical scan
machine and by hand.
A somewhat different
approach is taken by Populex. Rather
than marking an already printed optical scan ballot, as is done by the VES, the
Populex system, which also provides attached earphones, prints an optical scan
ballot containing the voter’s selections that can be verified by both the
sighted and the vision impaired.
But
it’s not even necessary to spend a lot of money on computer based voting
machines to allow blind voters to vote unassisted, as Rhode Island has
demonstrated with low tech tactile ballots for vision-impaired voters.
Finally, we agree with Maxwell’s statement
below, but perhaps not for the same reasons as she:
If only the paper record is corrected when the voter affirmatively
rejects the first paper record, then the DRE mechanism itself is superfluous.
In effect, the costly internal mechanisms of the DRE would be disregarded and
the DRE system would be reduced to being a paper-record generating device.
The DRE mechanism should indeed be
superfluous. Many of these machines
have been found to be faulty, and some are grossly insecure. We cannot trust our democracy to such
devices. If people insist on using
DREs, at a minimum the DREs should be required to produce a voter verified
paper ballot. As Maxwell correctly
observes, there may be problems with a DRE combined with a VVPT. Unfortunately, the alternative with no VVPT,
is far worse.
The LWVUS should be working with election
officials to aid them in obtaining refunds and using that money to purchase
secure and reliable machines.
Barbara Simons, Ph.D. Computer Science, LWV Palo
Alto, CA
Janet Anderson, LWV Seattle, WA
Tanya Baumgart, Immediate-past Co-President, LWV Bellinghim/Whatcom County, WA
Marion Beddill, LWV Bellingham/Whatcom County
Judy Bertelsen, Ph.D., M.D., LWVBAE (Berkeley, Albany, Emeryville), CA
Roberta Bradbury, LWV Member since 1957, former President LWV
Colorado, current member Pikes Peak LWV, CO
Barbara Calef, President, LWV Los Alamos, NM
Katherine Campbell, LWV Los Alamos, NM
Ernest J. Dieterich, LWV Winchester, MA
Carma D. Forgie, LWV Arlington, MA
Linda Freedman, LWV Marblehead, MA
Shirley M. Jin, Co-President, LWV Space Coast, FL
Genevieve
Katz LWV Oakland, CA
Lee Mondale, President LWV Marblehead, MA
Jo Morgan, Immediate Past Co-President, Board Member, LWV Bellingham/Whatcom
Co., WA
Richard Neavel, Ph.D., LWV Austin, TX
Debbie L. Nuss, President, LWV Manhattan/Riley County, KS
Diane Park, LWV San Joaquin County, CA
Mary E. Porter, Board Member, LWV Worcester, MA
June A. Rusten, LWV Ann Arbor Area, MI
Samuel A. Scharff, Leader, Southend Evening Unit, LWV Seattle, WA
Rebecca Shankland, LWV Los Alamos, NM
June A. Rusten, LWV Ann Arbor Area, MI
Lee Ziegler, Spokesperson, LWV Pikes Peak Region, CO