The most important aspect of a voting system, with respect to accuracy, integrity and security, is whether or not it is independently auditable. That is, the very prerequisite to accuracy, integrity and security in today’s voting technology is that there be a voter-marked paper ballot, or at least a voter-verifiable paper audit trail (VVPAT), for every vote cast. This ensures that election officials will have something they can use to confirm whether or not the electronic tallies produced by the voting system accurately reflected the intention of the voters.
Computerized voting equipment is inherently subject to programming error, equipment malfunction, and malicious tampering. It is therefore crucial that voting equipment provide or require the use of a permanent record of each vote that can be checked for accuracy by the voter before the vote is submitted, and is difficult or impossible to alter after it has been checked. Many of the Direct Recording Electronic (DRE) systems used in the US do not satisfy this requirement. Requirements for VVPAT have been established in a majority of states through legislation or through executive. Several States, while not formally requiring VVPAT, have nevertheless chosen to employ paper ballot systems voting systems. Three States (Maryland, New Jersey, and Tennessee) have enacted laws requiring VVPAT but have delayed implementation. (Click to enlarge the map above to see what states have passed requirements for a voter verified record. The relevant legislation in each State can be viewed on the right.)
The two most commonly used forms of these independent records are paper ballots, which are filled out by the voter (“voter-marked”) either manually or through the use of an assistive interface known as a ballot marking device, and can be tallied by a scanner or counted by hand, and VVPATs, which are contemporaneously printed by DRE voting machines. Sighted voters who use DRE voting machines with paper trails have the opportunity to review a paper record of their vote before casting it. Voter-marked paper ballots and VVPATs should be treated as the vote of record in all counts, audits and recounts where practicable. If DRE systems remain in use, they should not be used without a VVPAT printer, guidance to ensure that voters check the paper records for accuracy when voting; and sufficient emergency paper ballots on hand in case of machine failures or malfunctions. Sixteen states use DRE voting machines without a software independent voter-verifiable paper record as the standard polling place equipment in some or all counties. In these states, there is a risk that vote totals could be corrupted or lost, disenfranchising voters.1
Voter-Marked Paper Ballots offer superior records for the following reasons:
Paper ballots provide better audit and recount records. While no voting system is perfect, the authors believe that paper ballots marked manually by the voter or through the use of an assistive ballot marking device can create superior records to be used in audits and recounts. When a voter manually marks a ballot, he or she tends to check it in the process of marking it. When a voter marks a ballot using an assistive ballot marking device, that device enables the printed marked ballot to be reviewed through audio readout, by re-inserting the ballot into the device. In contrast, if the DRE prints a VVPAT, it only becomes “voter verified” if the voter knows –and takes the time– to check it.
Most currently available VVPATs are small, usually viewable through a small window on the voting machine, and the font in which they are printed is also small. This makes them much harder to read than a full size ballot, decreasing the likelihood that all voters will confirm them. That compromises the value of VVPATs as audit records as compared to voter-marked paper ballots. In addition, paper ballots must be sturdy enough to be fed through a scanner and are therefore generally more durable than, for example, standard copier paper. That makes them easy to handle and unlikely to be damaged during even multiple hand-counted audits and recounts. In contrast, the VVPATs currently in use are less durable than standard copier paper, more fragile, subject to loss of data if exposed to heat, and more difficult to handle during a hand-count audit, because they are generally printed on thin paper similar to that used to print receipts from ATMs or cash registers. This further compromises their value as audit records as compared to voter-marked paper ballots.
VVPATs are not accessible audit records, while paper ballots marked by accessible ballot marking devices can be. With a VVPAT-equipped DRE, only the DRE itself is accessible to voters with disabilities; currently systems do not provide audio read-back of the printed record for voters with limited or no vision. Some voters with limited or no vision can currently verify a paper record through the use of assistive ballot marking technology, which enables audio readback of the voter’s choices from the printed and marked ballot.
“A voting system is software-independent if an undetected change or error in its software cannot cause an undetectable change or error in an election outcome.”
In response to the concern that software errors in voting machines could result in inaccurate readings of votes, or votes being lost entirely, the Technical Guidelines Development Committee of the Election Assistance Commission recommended new standards (although this proposal has not yet been adopted) for future voting systems that would require voting systems to produce a voter-verifiable voting record that is independent of the software. A voting system that is not software-independent is said to be software-dependent it is, in some sense, vulnerable to undetected programming errors, malicious code, or software manipulation, thus the correctness of the election results are dependent on the correctness of the software. In terms of currently available voting technology, when there are no voter marked paper ballots or voter verified paper records of the vote, systems are considered “software dependent” and therefore not independently auditable.
The history of computing systems is that, given improvements and breakthroughs in technology and speed, software is able to do more and thus its complexity increases. The ability to prove the correctness of software diminishes rapidly as the software becomes more complex. It would effectively be impossible to adequately test future (and current) voting systems for aws and introduced fraud, and thus these systems would always remain suspect in their ability to provide secure and accurate elections. A software-independent approach to voting systems will provide voters with an assurance that errors or fraud in election results can reliably be detected. (Ronald L. Rivest and John P. Wack, On the notion of “software-independence” in voting systems, 2008)
While several legislative proposal were introduced after the 2000 Election, it was only after problems with the new touch-screen voting machines in Miami-Dade County in the 2002 Florida Primary that Congress passed the Help America Vote Act of 2002 (HAVA.) This act provided a huge infusion of cash so that states could buy new voting equipment and to update voter registration databases. Many states moved quickly to purchase high-tech electronic voting systems, buoyed by the assurance that they were accurate, accessible, reliable, and secure.
Unfortunately, these assurances turned out to be overly optimistic at best, and misleading at worst. In their eagerness to have the most modern and best election equipment, and to take advantage of almost $4 billion in federal funding, well meaning election officials were quick to accept the claims of voting system vendors. Few questions were asked about crucial issues. How secure and accurate are these machines? How easy are they to use? How could an election audit or recount be conducted? There was little or no consultation with independent technical experts on these questions, and remarkably little scientific research. The implicit assumption appears to have been that no recount would ever be needed, because the new systems were so completely secure and reliable that there would no longer be any reason to challenge an election result.
HAVA also created the Federal Election Assistance Commission (EAC) to oversee both the disbursement of federal funds and the development of new voting machine standards. However, the rst EAC Commissioners were not appointed until December 2003. The EAC had insucient funds to properly oversee the disbursement of $1.495 billion allocated in fiscal year 2003 to buy voting systems, a matter of great concern to EAC Chair, DeForest Soaries. The Technical Guidelines Development Committee, charged by HAVA with writing new voluntary voting system standards, was not even empaneled until June 2004. Meanwhile, states were supposed to have replaced their voting systems by the November 2004 elections, or January 2006 at the latest.
Instead of the promised major reform, HAVA engendered new kinds of election problems. Although DREs had been in use since the 1980s, an unrealistically short deadline, together with a lack of reasonable standards, triggered a massive deployment of faulty, flawed, and expensive equipment. This deployment has led to security and integrity crises for which there are no clear-cut legal remedies.
On May 22, 2003, Rep. Rush Holt (D-NJ) introduced The Voter Confidence and Increased Accessibility Act of 2003 (H.R. 2239) which called for a) a voter-verified paper record suitable for a manual audit, b) no undisclosed software, and c) manual mandatory random audits of the voter-veried paper records for federal elections in 0.5% of each state’s jurisdictions. Had the bill passed, paper records and audits would have been required for the November 2004 election, and verifiable voting systems would have been made available for voters with disabilities by January 1, 2006, earlier than mandated by HAVA. While generating considerable support and serving as a model for legislation in several States, HR 2239 was never scheduled for Committee action or a floor vote.
In early February 2005 Holt introduced a second version of his bill. H.R. 550 would have taken effect in time for the next Federal election, which would have been the November 2006 mid-term elections. The legislation also required a voter-veried paper record and random manual audits|this time in 2% of all jurisdictions. It again prohibited the use of undisclosed software, wireless communications devices in voting systems, and voting machine components connected to the Internet. The most substantial dierences between H.R. 2239 and H.R. 550 were in the audit section, which grew from one paragraph to more than six pages. The new audit material was in direct response to the manner in which the 2004 Ohio recount was conducted. Like HR 2239 was never brought to a Committee or floor vote.
Holt introduced a third version of his bill, H.R. 811, in February 2007. A companion bill, S. 559, was introduced in the Senate by Sen. Bill Nelson (D-FL). Like its predecessors, H.R. 811 called for random manual audits, as well as the public disclosure of voting system software and a ban on Internet connections for voting machine components. Also like its predecessors, the bill was vetted with computer security experts and voting integrity and disability activist groups, as well as election officials. H.R. 811 mandated voter-verified paper ballots, instead of records.
Responding to the problems in Cuyahoga County, Ohio in May 2006, where 10% of the paper printout-outs from new DRE machines were lost, damaged or otherwise compromised, the bill required paper ballots to be “durable,” i.e. capable of withstanding multiple recounts by hand. Because of concerns that ballot marking devices might create problems for voters with mobility impairment, the bill called for the entire process of ballot verification and vote casting to be equipped for individuals with disabilities. Based on recommendations from the Brennan Center, the strengthened auditing provisions included a “tiered” system to reflect the closeness of announced election results. The bill also required audits to be publicly observable. H.R. 811 was marked up by the committee of jurisdiction, but was not voted on by the House.
H.R. 2894, introduced by Holt in June, 2009, was based on the mark-up version of H.R. 811. H.R. 2894 required voter-marked or ballot-marking device paper ballots for the November 2010 elections, made the paper ballot the vote of record (as had all earlier versions), mandated the same tiered audits as H.R. 811, and banned wireless devices, Internet connections, and uncertified and undisclosed software in voting and tabulating machines. The ballot marking requirements would have banned DREs. Sen. Nelson again introduced a Senate companion bill, S. 1431. Although supported by the broadest range of organizations of any version of the bill (including the American Council of the Blind, the Advancement Project, the Brennan Center, Common Cause, the Electronic Frontier Foundation, Voter Action, and Veried Voting), and endorsed in a New York Times editorial, the bill received no committee action and no floor vote.
- Counting Votes 2012: A State by State Look at Voting Technology Preparedness, Verified Voting Foundation, Common Cause, Rutgers University School of Law, 2012, p. 19-20. ↩