Feds To Recommend Paper Trail for Electronic Votes

flanksteak writes "The National Institute of Standards and Technology is going to recommend the decertification of all electronic voting machines that don't create paper records. Although it sounds like this recommendation may have been in the works for a while, the recent issues in Sarasota, FL (18,000 missing votes) have brought the issue a higher profile. The most interesting comment in the story comes near the end, in which the author cites a study that said paper trails from electronic voting machines aren't all they're cracked up to be."

Well it's about time...

actually it should never have been without a paper trail.
It's not like we don't have enough prior experience with data losss not to know how useful a paper trail is.
And the government with its sexdulpicates should have already know it.

Re:

Thing is, depending on whether or not the machine prints a human readable output only then it could be made to lie on the paper record as well.
-nB

Paper records

"Thing is, depending on whether or not the machine prints a human readable output only then it could be made to lie on the paper record as well.

But if a paper copy is given to the voter, then lies are caught.

Re:

That's not necessarily true. The machine could be made to print the votes that the voter made on paper, but to actually submit fixed votes electronically.

Re:Paper records

Doesn't matter. In the case of a recount, the paper ballots---the ones the voter verified---are used.

Re:Paper records

First of all the paper document in the HBO documentary that was fixed to show incorrect results was produced by a central tabulator computer that reads aggregate results from memory cards. If the individual voting machines print out a paper trail of each voter then the the individual voters can catch the erroneous paper trails. This is not true if only the central tabulator machines have paper trails. So this recommended solution is totally different than the situation in the HBO documentry.

Secondly each electronic voting machine can be equipped to output paper records that can be scanned optically. The paper record outputted is checked by the voter and then it is summited to optical scanner where then and only then it is counted. Therefore you can have the benefits of electronic selection of votes and paper records that are transparent to the voter and can be recounted.

too late

if you haven't seen "Hacking Democracy [hbo.com]" you better.

Legitimate copy of Windows XP

I assume you realize that anyone who can hack the voting machine can also hack it so that the paper print-out will indicate your correct vote but the record on the card will be another set of votes, not what you made. The security of the system depends upon the integrity of the clerical staff in charge of the balloting system, it always has and always will. If you can't trust them, and make certain that some independent experts, who have to post bonds certifying the system is clean, certify and assure that no one has unauthorized access to the machines and all connections until the vote is tabulated. That will cost a little more but will put someone's money on guaranteeing that no one tampers with your vote.

CBS

Re:Legitimate copy of Windows XP

Thats why the voting machines should not keep track of any results. The voting machines should just print out a ballot with your choices you selected from the touchscreen. The tally should be done at the optical scanner that scans in the printed ballots. The optical scanner/tabulator software of course should be bulletproof and not easily modifiable. The physical security issue would be easier in this case and the real records are always the paper ballots with the tabulator output as the intermediate records.

Re:

No matter how long you make the chain. It's still as strong as the weakest link.

What is essentially the difference between the voting machine itself counting the tally, or that optical scanner?
Do you trust the software inside that optical scanner? (even th

Missing the point

You sort of missed the point of paper trails.

In US States with competent electronic voting standards such as Nevada, a third party audits a random sample of all machines (usually 1-3% in practice, which is adequate), comparing the paper results with the el

Re:

We need to ditch the high-tech whizbangs entirely. Pencil on a paper ballot works. Not every new technology is good, or old one bad.

Paper voting!

Why do we have to overly complicate voting in this country anyway? Other Western democracies make do just fine with pencils and paper, so what's the reasoning behind using electronic voting machines in a country where most people can't set the clocks on their VCRs?

Re:

It's not my fault the clock is round and keeps rolling off.

Re:Paper voting!

Remember the vote for leader of Iraq that Our government bragged about? The one with the election that we setup to be fair and honest? People voted by dipping their thumb in ink, and then voting for the canditate by pressing their thumb next to the candidate.. No duplicate voting, since its obvious when someone walks in with a purple thumb.. Simple, effective, and fair... And people were told to "Twist" their thumbprint to make sure that the print wasn't readable..

Re:

And people were told to "Twist" their thumbprint to make sure that the print wasn't readable..

Many countries just dip the thumb in ink when credentialling is complete. The actual ballot is marked with a pen.

The ink can be washed off

In that very same election that you are talking about people found that they could wash the ink off and voted twice. You should have known it wasn't entirely true when our government bragged about it. It's a shame that the american media has become lazy

Re:

Because if you did it that way, with the number of questions on a given ballot form it gets very unwieldy. What REALLY needs to happen is the decoupling of trivial local (citywide, countywide) ballots from presidential and congressional ballots. KISS.

But o

Re:Paper voting!

Because if you did it that way [paper and pencil], with the number of questions on a given ballot form it gets very unwieldy.

I don't buy that a paper ballot can't work. I voted absentee in the midterms (I'm studying abroad), and I had a total of 15 elections, with as many as 9 lines each, and a total of 12 different political parties. This even included such oddities as the "Rent Is Too High" party. Fit perfectly fine on a 11x17 sheet of paper. vote once in each column, each row is for a political party. The page was about 3/5 full, so probably 8 more elections and 7 more parties could have fit.

The ballot made sense, was easy to fill out, and included space to write in. I know cause I used that space in a couple of elections where I reviled both candidates. So to your complaint of unwieldy I say no good sir.

Re:

what's the reasoning behind using electronic voting machines in a country where most people can't set the clocks on their VCRs?

The people who can't set the clocks on their VCRs (who are, incidentally, the majority) think that "computers make things mor

Re:

Or you could use a pen and an optical scanner like the entire state of New Mexico did.

And like New Zealand does. Sure our voting population is only about two million people, but we get voter turnout in excess of 80% and still have results for most ele

Best solution I've seen

http://www.forbes.com/opinions/2006/11/10/voting-f raud-security-tech-security-cz_bs_1113security.htm l [forbes.com]

This article came out in forbes a while back and the author has the best solution I've seen for verifying votes on electronic voting machines. He proposes having a touchscreen computer to make all of your ballot selections and when you are done and hit vote it prints out a piece of paper with your sslections. You then can verify your votes were recorded correctly before putting your ballot in a box so that it can be run through an optical scanner at the end of the day to count the votes.

Re:Best solution I've seen

How is that better than voting by marking up a heavy card stock ballot with a marker and running it through an optical scanner? If the goal is to minimize steps, why have the touch screen mumbo jumbo at all?

Plus, a sharpie is a lot cheaper than a tablet computer with built in printer.

Re:Best solution I've seen

How is that better than voting by marking up a heavy card stock ballot with a marker and running it through an optical scanner? If the goal is to minimize steps, why have the touch screen mumbo jumbo at all?

Because, with a computer-generated card, the result should be more or less binary -- either Bob voted for a candidate or he didn't.

With a card filled in by a voter, there can be some debate about how complete a mark must be before it counts. Witness the hanging chad hell in Florida.

(OTOH, with computer generated cards, since they are computer generated, it should be trivial to print out fake ballots and stuff the box. But the fake ballots will lack different and unique finger prints.) :/

Selling targeted ads on voting machine screens

The real reason they want to use touch screen voting machines is so they can pay for all the new equipment by selling targeted ads on the touch screens. As you vote, the ads will be tailored to the demographics of the candidates you support.

-Don

Re:

He proposes having a touchscreen computer to make all of your ballot selections and when you are done and hit vote it prints out a piece of paper with your sslections.

This exists and is sold by a major voting machine manufacturer. [essvote.com] They sell it more for the

Re:Best solution I've seen

The problem with this idea is the same problem with all electronic machines: It's a colossal expense to do something that would be handled just as well with $0.10 marker.

There are problems with any voting system. Here's the basic rundown:

1) Mechanical lever, paperless: a machine in which the voter sees the whole ballot, sets switches to indicate their vote, and pulls a master lever to cast the vote, which mechanically adjusts a counter mechanism that is recorded by hand after voting has closed. Problem: the gears can jam. This has happened before, and officials can generally identify jammed machines by an anomolous number of 9s -- the machine fails to advance beyond 9 in a given column because that requires the turning of two counting wheels rather than one, Trust me it's happened, and this is why mechanical levers countinue to be used in only a very few jurisdictions.

2) Punch card, paper: the voter indicates their choice by putting the ballot into a machine which makes a physical hole in the ballot that can then be read and counted by machine. Problems: There is no chance to correct a mistaken vote except by spoiling the ballot. An incomplete puch can lead to incorrect tabulation (hanging chads). Perforations that were not voted can still fall out before tabulation, meaning an overvote and an invalid ballot. Florida 2000. This is why virtually no jurisdictions still use punch cards.

3) Optical scan, paper: the voter indicates their choice by marking a paper ballot -- generally by making a mark in a given area of the ballot. Problems: Voters fail to follow directions and make marks other than where they're supposed to (eg circling names rather than checking boxes). Optical scanners identify stray marks as votes (or overvotes), or fail to identify votes. Folded or damaged ballots (particularly in the case of absentee ballots) cannot be read by machine. Optical scan ballots are still very popular, and probably the best solution now being used.

4) DRE - direct recording electronic, paperless or optionally with a voter-verified paper audit trail (VVPAT): A voter makes their selection through a touchscreen, keypad, or audio interface and the vote is recorded digitally onto a removable storage unit -- generally a PCMCIA card. Some units feature a simultaneous paper record to present the voter with a hard copy representing their vote. Problems: No transparency between the casting and counting process. No software independence -- the tabulation of votes is dependent on the same software that records the votes. No independent auditability -- there is no way of verifying that the voting and/or tabulation software has not been compromised. No physical record of the vote when there is no VVPAT, and no dependable physical record when there is a VVPAT.

Paper trails are the most failure-prone parts of the machine and offer no effective protection of the process -- printers can fail, paper loaded incorrectly, ink runs out, paper jams, paper runs out, etc, etc, etc. If it can happen it will, especially in a machine whose hardware is little tested and whose software is engineered on short notice (due to election law that often changes dangerously close to elections), and a machine designed to be used only a couple times per year.

5) All-mail: this is a system that is being pioneered by Washington State -- all voters vote by absentee ballot delivered through the mail. Eliminates the need for polling places, poll workers, etc. Problem: Opens the door widely to massive vote fraud.

6) Colored Stones Cast into an Urn, paperless: A very effective system used in ancient republics wherein voters would indicate their choices by placing stones of different colors into given vessels to indicate their vote. No question of hanging chads, hacked machines, misunderstood ballots, etc. Problems: Not machine readable, somewhat impractical for large precincts and long ballots, expensive and difficult to transport and verify stone counts. Very, very few governments or municipalities have used this me

GREEeeeaaat Idea

Make it so that the VOLUNTEERS who run the voting locations can be thrown in jail if they make a mistake. That'll really encourage more people to help out.

Paper trails vs. paper ballots

Part of the problem with the "paper trail" issue is that the idea keeps getting transformed, by gradual steps, into something that is totally useless. The paper gets put behind glass, printed on a roll, no recourse if it's too fant to read, etc. until there's no reason to suspect that it represents the voter's intentions and not some hacker's.

The ballot needs to be tangible, a physical object that the voter can inspect (handle, read and verify) and it should be the official record of the vote. If you want to have the touch screen machine give you an insta-count, fine (though I wouldn't) but the actual ballots should also be counted, every time, by hardware too dumb to hack, and if the counts differ the physical ballot count should be the one that is used.

--MarkusQ

the Draft NIST recommendations are pretty good!!

Actually this time just RTFA isn't enough. You need to read the whitepaper as well.

It appears that at least one federal agency has not turned to the dark side. The draft NIST white paper recommends a voter verifiable paper audit trail that is also the ballot of record, AND robust auditing. I was very pleased to read it. I hope the final document isn't watered down, and I hope this or something similar is implemented in time for the 2008 election.

The premise of the whitepaper is that no software dependent system for counting votes (like a touchscreen with no paper ballot) can be fully vetted, and that they should never be used without a software independent record for use in mandatory statistically robust audits.

In other election reform news... There is an organization that has been a key mover in the election reform movement called electionarchive.org. They did a lot of very interesting statistical analysis of the 2004 elections and found some startling results. They have made a very solid list of 15 legislative recommendations. They can be found here:

http://electionarchive.org/ucvInfo/US/EI-FederalLe gislationProposal.pdf [electionarchive.org]

here is a list of the electionarchive.org recommendations
1.Manual Audits
2.Voter Service Reports
3.Auditable Voting Systems
4.Fund Manual Audits and Voter Service Reports
5.Teeth (enforcement)
6.Public Election Records
7.Election Monitoring Website
8.Submission of Reports
9.Public Disclosure of Voting System Software
10.Prohibit Certain Network Connections
11.Qualifications for Technical Guidelines Development Committee
12.Public Right to Observe
13.Vote Count Audit and Recount Committee
14.Repository for Voting System Disclosure
15.Prohibit Practices that Disenfranchise Voters

Re:

Speed. There are all sorts of reasons that speed is valuable, from the voters' desire for instant gratification, to extending the amount of time that a newly elected candidate will have to prepare for his or her new office, to the financial markets handic

As a matter of accounting....

It seems to me that ATM machines get a great deal more use and account for a great deal of money. They give a receipt and also have an internal paper log. It takes two people to open one up legally ....

You'd think this was new technology in light of the voting machine problems.
But ATMs have been in use for at least a quarter century.

Re:As a matter of accounting....

There is a fundamental difference between an ATM and a voting machine, though. In an ATM, you MUST keep track of the user who was standing at the machine doing the transaction. With a voting machine, you MUST NOT keep track of who is standing at the machine at any given time. Doing so could leak information about how that person voted.

And, as has been proven, a company that can do one well can real screw up the other (hint: begins with a 'D' and rhymes with "re-told").

-J

Re:

But ATMs have been in use for at least a quarter century.

ATMs are not as mission critical as voting machines are.

No one ever needs to use an ATM. They can always use another, or they can just go into the bank, but the voting machine needs to work right, fr

Nobody's decertifying anything

You've got it wrong. NIST is not proposing to decertify anything. The white paper only talks about proposals for what requirements ought to be in the 2007 federal voting system standards. Read the white paper.

That will make me feel better

I'm far from a conspiracy theorist but the more I read the more convinced I am that there is something rotten in Denmark...or at least the RNC and their cronies. Check out http://www.tpmmuckraker.com/archives/002027.php [tpmmuckraker.com] for the scary details on the FL-13 race. More than 18,000 voters in primarly Democratic leaning areas showed NO vote for the Congressional candidate. An excerpt from the Orlando Sentinal:

The group of nearly 18,000 voters that registered no choice in Sarasota's disputed congressional election solidly backed Democratic candidates in all five of Florida's statewide races, an Orlando Sentinel analysis of ballot data shows. Among these voters, even the weakest Democrat -- agriculture-commissioner candidate Eric Copeland -- outpaced a much-better-known Republican incumbent by 551 votes....

Re:

Sorry, Dems have been stealing elections since way before. As I recall, Kennedy got Chicago by enough votes to get the electoral count needed to beat Nixon---and the needed votes "showed up." Don't blame the RNC when the DNC is just as guilty. This is not

Compounding Bad Ideas

Let's face it, e-voting is a dumb idea. It's bad solution to a host of problems that never existed outside media and lobbyist FUD and creates more problems than it will ever be worth. "Fixes" to it will make it worse. Want a paper trail? Use paper ballots.

Timing is Everything

Fascinating that the NIST requires an evidence trail only after Bush is no longer involved in a single election, only weeks after Democrats take back control of Congress.

So the law makes it harder for Democrats to steal elections like Republicans could get away with for years.

Though I bet Jeb Bush (R-FL) is pissed.

Next up, a law against lying the US into war. Or maybe against spending $TRILLIONS in debt. Against ignoring PDB warnings of terrorist attacks? Or maybe against NSA warrantless wiretapping. It all looks so much more sensible to live in a democracy when you're a civilian than when you're "the decider".

San Francisco machines are the best IMHO

I think that the voting machines that San Francisco uses are the best design so far. We get a paper form on which you mark your vote (by drawing a line next to your choice). If you are voting in person, you feed the paper into a machine that 1) Alerts you if you overvoted or didn't mark anything 2) Counts the votes and 3) Stores the marked paper ballot.

This system has all the benefits: the preliminary results are available immediately from the electronic machine, there is a complete paper trail, you know if the machine couldn't read the ballot, and absentee ballots look exactly the same as the ballots in the precinct. Why isn't this system used everywhere?

Make this a priority for next year

Wow, great timing!

Democracy for America, the follow-up to Howard Dean's Dean for America organization, is running a "Put paper ballets on the agenda" [democracyforamerica.com] drive right now. They want people to tell Nancy Pelosi, as the future Speaker of the House, to make this a priority for next year's Congress.

So if you care about this issue, make sure she hears about it!

For what it's worth, I filed testimony in the EFF lawsuit, OPG v. Diebold, where Diebold was suing kids who (like me!) posted to the Web copies of some Diebold memos [berkeley.edu] in which you can read about Florida precicints with negative 16,000 votes for Al Gore and Diebold "upgrading" the software to uncertified (read: "illegal") versions in California.

RA storage vs WORM type storage

'He pointed to a system devised by Ted Selker, co-director of the CalTech-MIT Voting Technology Project. "The state of the art systems aren't even on the market."'

Warning RANT!

Then the people creating the current systems should all be fired. What kind of computer scientist doesn't understand that with any random access storage there is a risk of accidental or intentional destruction or alteration, at any time, in a random fasion. That's why it's called uhh random access. Hello? This is like a CS 101 second week quiz question. They even still call it RAM!

Any write once technology will be infinately better. Which one is academic. You can use a variety of write once technologies with a diverse amount of write confidence levels, number of rereads possible and techniqiue used, and cost. Just write the votes at they happen, in a sequential fasion, in a way that you cannot backtrack and rewrite.

• a dot matrix printer?
• a laser printer?
• a cdrw?
• a writable dvd?
• a WORM tape drive?
• Sevral of the above?

Why the hell are do Sarb-Ox and Hipaa require worm tape and encryption in many cases, yet our voting systems have nothing but the seat of their pants.

As an aside Bruce Schneier [schneier.com] chimed in on this recently. I wonder if this had any effect on NIST's comments.

Why the rush to count votes?

Electronic voting benefits mainly the media. There really is not any real reason to have to produce the results of an election within hours after the polls close, except to support the media hype surrounding the election.

The ease of a voting system should not be directed towards the "counters", but towards the person voting and the people who need to be able to verify the counts during a dispute.

Use a simple paper ballot that the voter fills out (with maybe a mechanical/electronic assistance if needed), and places into a ballot box. The voter should not be able to walk out the door with any thing that can prove how they voted, as this can lead to selling votes or force someone to vote in a certain fashion (think of your boss saying that if you want to keep your job, you had to vote for X and bring in the proof).

Electronically/mechanically process the paper ballot to produce the counts. If there is a dispute the paper ballots are verified by hand counting.

The counting system should make a first pass through the ballots and perform a simple pass/fail on each ballot. Any ballot that fails goes to a hand count bin. The machine should be able to perform this "sorting" without human intervention (I believe that my local district's machines either require intervention with each failed scan, or simply indicates that there were failed scans within a batch).

Yeah, well...

Ballot boxes go "walkies" all the time, which is important if you have specific districts that are likely to vote in opposition to however you happen to feel. As such, there needs to be much more security on such stuff before I'm willing to take it seriously.

One thing I'd like would be for the electronic machine to generate a cryptographically-secure hash generated from all the votes cast on it. The paper ballots can then be electronically scanned and the same hash algorithm applied to the scanned data. If ALL votes are present and unmodified, then the hashes should be the same. Provided there is no collusion between the voting machine and the scanning machine makers, the probability of the hashes coming out the same in the event of vote-tampering of any kind should be extremely low.

However, knowing that tampering has occurred doesn't solve the issue of what to do about it. I'd simply insist on the election being re-held until all districts came back clean from tampering. Oh, and all sports, adult and cartoon channels would be legally required to stop transmitting until everyone bloody well voted and/or adjudicated honestly. Also, anyone caught attempting (or practicing) voting fraud should be compelled to buy everyone the DVDs of the shows they missed, before being locked up in a psych ward in Romania for the rest of their unnatural life.

What Problem are We Trying to Solve?

Seems to me like Americans have this cultural thing that causes us to believe that complex, untested, technologies must be superior to the old fashioned way. When I was a kid during World War II, I used to thumb through the back pages of Popular Mechanics where they had pictures to these neat weapons that would surely bring the axis to its knees. Sixty years later, we STILL can't build usable versions of some of those things.

If the problem is that people make mistakes in counting, mark and scan technology should produce better results. If the problem is votes from dead or imaginary voters, how can any technology help?

If there is, as I suspect, no real problem at all, why the hell are we stumbling around with all this half-baked technology?

Paper Ballots: Shorter Lines?

In my little town in Vermont there was no line to vote because there were probably 20 completely private booths and 40 semi-private counter spots in which to fill in the little bubbles on the optical scan card with permanent marker.

All other issues aside, there is no possible way we could afford anywhere near that many touch-screen machines. Even barring technical problems this is bound to cause a bottleneck as people ponder their vote.

Re:What about to make election transparent?

You don't want a transparent election. While times are not tough now, they may be in the future, and you never know what kind of trouble those around you could create if they knew or could find out who you voted for. Voting is a anonymous and deniable for a reason.

Re:

The only real solution to this whole mess is to add a 'None of the above' to the list. I'd punch that as many times as registering a vote.

I fail to see how that is a solution to anything. Why go through all of that trouble just to not vote? If you are ju

Re:And this will accomplish what?

Not a receipt. A receipt is a bad idea. A verifiable paper trail. If you need to involve computers (the only semi-legitimate reason that I've seen involves handicapped voters), then have the computer print the marked ballot. The person inspects it and then puts it into the ballot box. That is the official ballot. The person does not take a receipt with them. That makes it too easy to coerce people to vote a certain way, or punish them if they vote the wrong way.

optical scan is the real deal

Currently I lean toward optical scan, filled in by the voter and not by machine, with readers set to reject invalid ballots with helpful error messages ("Looks like you voted twice for Congress")and trigger a shred-it-log-it-replace-it procedure.

This is pr