On November 21, 2019 we revised Verified Voting’s Policy on Direct Recording Electronic Voting Machines and Ballot Marking Devices to remove a reference to parallel testing on page 8 of the original document.
Although the concept of parallel testing has been discussed for more than a decade, we recognize that few if any jurisdictions have actually used it and its utility for detecting any problems with elections has not been demonstrated. Consequently, we are removing the reference.
To see the originally published version, click here.
Today, Verified Voting published its policy statement on Direct Recording Electronic voting systems and Ballot Marking Devices. We published this statement because many jurisdictions either have replaced or are in the process of replacing older vulnerable systems. In striking contrast to the last time states replaced voting systems after the passage of the Help America Vote Act in 2002, this time the consensus is that voting systems must have a paper record.
But it’s not enough for a voting system to “check the box” on paper – to print paper records that voters may not even notice or examine. To be trustworthy, elections need to be based on voter-marked paper ballots. Whether these ballots are marked by hand or by device, for them to be considered voter-marked, voters should know what they say!
For Ballot Marking Devices (BMDs), that means the systems, and the procedures around them, should demonstrably support voter verification. They should ensure that voters deliberately and intentionally check their printed ballots carefully enough to detect, correct, and report any errors. It also means that poll workers should be trained to follow specific protocols if BMDs are not recording voters’ intent accurately during voting.
It is far from clear that any currently available BMD meets a high standard of voter verification in practice. Published research is scanty, but it suggests that many voters may barely look at their ballots – let alone look closely enough to notice any changes. This is a usability defect that threatens election integrity. If voters are unable to use voting systems and election procedures safely, the systems and procedures must change to protect our elections. Now is the time to revisit those procedures and adapt them to optimize the use of new technology.
Because jurisdictions must have an accessible device in the polling place to accommodate voters with disabilities and because we are seeing a trend of jurisdictions choosing BMDs for all voters, we urge jurisdictions to choose wisely among the various commercial offerings and avoid systems that present unacceptable security risks. We’ve described the BMDs that no voter should use because they are too insecure and we don’t think voters with disabilities should have to use a voting machine that is considered too dangerous for other voters. Moreover, if BMD use is limited to voters with identified disabilities, voter secrecy could be compromised. That’s why we recommend, in a precinct with only one or two BMDs that an adequate number of voters be encouraged to use them. If, as we recommend, jurisdictions give voters the option of choosing whether to mark a ballot with a pen or use a BMD, and poll workers know that a significant number of voters will use the BMD, then it is much more likely that the poll workers will know how to set up the BMD, it will be set up and ready, poll workers will know how to instruct voters on its use and voters will know how to use it.
Given present knowledge, we think the best approach has some basic elements:
- Select BMDs that are easiest for voters to verify. Avoid BMDs with radical flaws such as being able to add, change, or destroy votes on ballots after voters cast them.
- Allow in-person voters to choose between hand-marking ballots and using BMDs. When a polling place has one or two BMDs, a variety of voters should be encouraged to use them.
- Make sure contingency plans are in place for everything that could go wrong with BMDs, from isolated malfunctions through massive subversion. Such plans include having emergency paper ballots on hand in precincts that use BMDs for all voters.
- Systematically study best system designs and procedures to ensure that votes are verified and protected. Support continuous improvement in systems and procedures.
Our policy statement is about 4,000 words long, though we could say far more. We plan to revise our policy based on emerging research and practical experience with new voting systems. We’re especially eager to watch the roll-out of Los Angeles County’s ambitious VSAP system. We do not think we or anyone else has all the answers about how best to combine security, accessibility, verifiability, and usability for all voters. We have had some long and sometimes difficult conversations about these topics, and we look forward to more.
You can read the full policy statement and background rationale here.