Computer Scientists Rally for Reliable Voting System

Kim Alexander writes "Silicon Valley computer scientists, led by Stanford professor David Dill are asking Santa Clara county to purchase a new computerized voting system only if it provides a voter verified paper trail. Their concerns are based on the lack of adequate testing of these voting systems, and the fact that the software is closed-source and proprietary. Requiring a voter-verified paper trail will mitigate many of these problems. Dill's 'Resolution on Electronic Voting' has been endorsed by prominent computer scientists from all over the country, including Ron Rivest. Counties all over California and the US are going through a similar process. Patriotic nerds who want to do something to help protect our fundamental right to vote with confidence that our votes will be counted can help by contacting their state and local reps, writing letters to supervisors and getting informed!"

Covered on NPR earlier this week?

[Anonymous Coward]

Perhaps someone heard the interview on "Morning Edition."

Sorry I can't provide more details.

As if the "paper trail" is valid?

[Shivetya]

I understand the possibility of fraud and such... we had electronic voting here in Georgia this last election cycle and it did very well.

If your disabled you can get assistance, and the machines can voice the choices as well for vision impaired.

There is a review at the end of the voting processing asking you to verify the choices you made are accurately represented.

Votes are transmitted to a central site and kept in the voting machines. They have multiple ways to prevent loss of votes due to power outages as well.

What this all leading up to is, how can the suggestion of printing out votes at the end of the day be meaningful? If the voter isn't there to review their votes who decides that anything nefarious hasn't happened?

If anything, a paper trail AFTER any voters have left is more of a risk that not having one. Suddenly you get back into the days of ballot stuffing, but instead now you just invalidate votes as needed. (or call for a new election, hoping your side turns out more this time).

Electronic voting still doesn't stop dead people from voting either, they just file absentee ballots.

Re:Trail?

[zcat_NZ]

No, kiss goodbye rigging the elections and nobody being able to prove you did it.

Here's a hypothetical example. Some guy runs for his state; nobody really likes him that much and all the pre-election predictions are for the other guy. Then he wins, although the 'exit polls' suggest that most people were actually voting for the other guy. Then it turns out that he used to be the CEO of the company that makes the all-electronic voting machines used in this election, and a few people think this is mighty odd but there's no way to prove anything because his machines don't include any kind of audit capability.

I wish this was actually hypothetical.

Open Code Doesn't Guarantee Integrity

[Pave Low]

As it turns out, open code and "thoroughly examined hardware" do not a secure system make. The problem is that the code has to get compiled, and it has to run on an operating system, and that has to run on a computer. Even if the code and hardware (if one can examine the microcode) appears to be entirely pristine, Ken Thompson explained in his classic 1984 essay "Reflections on Trusting Trust" (available online, do a Google search) that the compiler that compiled all of that code can be rigged such that malicious code can be concealed. For example: Since the dates of US National Elections are fixed to infinity (they are always the 1st Tuesday in November) and since many voting systems (as well as computer systems) rely on real-time clocks, it is certainly plausible to create a hardware trap that only goes off on election day. And that trap doesn't have to be in the voting system either, there's tallying devices, reporting software, and so on. It's a nightmare. The only sane solution is to rely on a voter-verified physical audit trail that can be READ BY HUMANS in case of the necessity for a recount. There's a lot of ways this can be performed (including one by David Chaum that allows the voter to verify that their ballot actually was entered into the final tallies), and true improvements in voting systems will only occur when this is recognized and the "trust us" mentality (including one that says we should trust the people who will supposedly verify all the open code) is abandoned. Please read the extensive writings on Rebecca's website www.notablesoftware.com/evote.html as well as Peter Neumann's for more information on the subject. And for those of you who are convinced, PLEASE encourage all communities who happened to purchase fully-electronic voting systems to have them retrofitted with printers BEFORE the November general election. Brazil is doing just that, right now, with 3% of the 400,000 voting machines they purchased back in 2000 (more may follow).

grave disappointment....

[3-State Bit]

...that a resolution "endorsed by computer scientists" does not propose an instant run-off system, whereby each voter ranks the candidates in order of her preference. (She can vote traditionally by ranking only one candidate 1, and no one higher).

The benefits are enormous. The system is much less open to manipulation, and it is basically the only way for minority voices to be heard.

One cannot overemphasize the fact that today a rational voter will always choose the lesser of two evils, without considering candidates that are not evil, based on the mathematics governing her vote.

Let me repeat this: If you believe that a vote for the democratic candidate is a vote for evil, and you believe that a vote for the republican candidate is a vote for evil, and there is a third candidate whose views you agree with precisely, and who you think could fulfill the office perfectly were she elected (but there is zero probability of this, as there was zero probability of Nader's being elected) then under today's system your only rational choice is to forego your preference for the third candidate and vote instead for the lesser of the two evils. That is, you will be rationally impelled to vote for a candidate with whom you do not agree, when a minority candidate exists who could better represent you.

This is no less than mathematical extortion.

You can either participate in a two-party system, or "throw your vote away." It is, in effect, a mathematical equivalent of having a voting booth in which you are to choose betweeen seven candidates by putting your token either into the republican ballot box, the democrtatic ballot box, or the trash.

Everyone who voted for Nader in our last presidential election placed their vote in the trash, since there was zero probability of Nader's winning. (Exception: vote trading.)

Read more about instant run-offs here [fairvote.org], or do a google search.

RISKS -- comments re electonic voting

[MacAndrew]

The RISKS forum/digest [ncl.ac.uk] has had many, many articles on the potential and actual snafus of electronic voting; I thing the topic is a special interest of the digest's editor. Although the contributors are very much a part of the technology world, the mood there is pretty virulently anti-electronic voting unless there are old-school audit features such as paper trails. Closed source software is regarded very skeptically.

The most persuasive evidence is the actual experiences coming in from the field, around the planet. Many local governments are buying expensive new systems on surprisingly little information, and we may face problems like Florida's in no time -- but not actually realize it, for lack of auditing. I highly recommend flipping through the archive.

An Example of Closed Source

[Alien54]

I would recommend checking out this story, in which Senator Hagel Admits owning the Voting Machine Company [scoop.co.nz] that runs the elections in his state, Nebraska.

Completely coincidentally, Nebraska has a new law that prohibits election workers from looking at the paper ballots, even in a recount. The only machines permitted to count votes in Nebraska are ES&S.

And completely coincidentally, Senator Hagel has won recent elections by surprising margins. See also this capitol hill newspaper report [thehill.com]

there's more to this, but I can't find the links yet.

The risks could be more than just speculation

[sanermind]

Normally, I'm not the conspiracy-theory type, tending more towards occam's razor and healthy skepticism, but This article [commondreams.org], on an admitedly rather left-leaning publication, if at all accurate in merely it's factual assertions, disturbs me to no end. And of course, there's no mention in the mainstream media.

Re:Proprietary voting systems?

[Rivabem]

In Brazil we use a computerized voting machine that allowed the last election helded in october to have more than 95% of the votes counted 6 hours after the last voter left the voting section. And in most states 100% of them in less than 12 hours (we some _very_ far cities in some places).

The system is simply a x86 cpu and mobo, with a 4 to 16 gray tones LCD, a small printer and (in some, this time)a earphone for hearing-impaired voters.

After the section president inserts the voters id in a terminal, it send the e-ballot a unlock signal and the users is prompted to enter the candidates number (or press BLANK, since here voting is obligatory) and press CONFIRM if the right candidate's name, party number and photo appears on the LCD, or CORRECT if it's wrong. In the last case, the voter will be prompted again.

After having voted for all the positions in dispute, and confirmed them all, one at a time, a paper with all the votes is printed and showed to the voter, if all his votes are correct, he presses the CONFIRM button another time, and the voting is done. If not, press CORRECT and insert all votes again. If the users press correct, the machine prints "NULL" on the paper.

The paper trail is now cut, and falls into a black plastic ballot, so in case of recounting, it's there to confirm the numbers.

In the end of the voting day, a report is printed in each e-ballot, so the section president has automatically the number os voters to any candidate, blank votes and the numbers of abstentions

In Brazil que voting system is equal nationwide, and the voting sections are separated in electoral districts. In each district, there are 3 e-ballots choosen in a lottery way that are replaced the day before the election, and those 3 ones are used as test ballots, by party affiliates, to confirm that they print exactly the votes that are in the 2 floppys (master and backup) that are used in the counting

There's an OPEN SOURCE voting system available!

[aebrain]

Sorry, I'm a little peeved at writing the same darn URLs every time this comes up.

• Technical description [act.gov.au] by the ACT Electoral Commission
• Comments [tomw.net.au] by a user in the Australian Computer Society on how the system worked in practice.
• Executive Summary [act.gov.au] of how it worked.
• 1 MB PDF [act.gov.au] full report.
• And finally.... The Source [act.gov.au]

Jeez... I mean, it's been a while that this has been available. Posted several times on /.

Things you can do to help.

[daviddill]

1. Endorse the resolution on electronic voting. http://verify.stanford.edu/evote.html 2. Most people don't seem to know what's happening. Tell them about it, and point them to the web page. 3. If you live in Santa Clara County, CA, contact the election staff and supervisors to let them know you consider this an important issue. http://verify.stanford.edu/dill/EVOTE/scco.html 4. email offers of help to "[e-mail]". More ideas would be appreciated.