The perils of electronic voting

TRUST IN PAPERLESS SYSTEMS IGNORES CHANCES OF FRAUD, UNFORESEEN FAILURE

By Avi Rubin

In August 2003, a large portion of the Northeast United States, including all of New York City, suffered a two-day blackout because of a software glitch in one of the power grid control systems.

Last Sunday, thousands of airline passengers on American Airlines and US Airways were stranded in airports across the country because of a software glitch. US Airways was down for two hours; American was down for three. More than 200 flights were canceled. ``This has never happened before,'' said Tim Wagner of American Airlines. ``We were unaware that there was the potential for this to happen.''

Software glitches are no surprise to computer scientists. Software is highly complex, and large, computerized systems often fail in unexpected ways.

Experienced computer experts cringe at the thought of relying on fully automated systems for critical operations. Nowhere is this more pertinent than in voting.

There is a reason that the vast majority of the computer-science community, the very people who dedicate their lives to pushing the envelope of technology, are in almost uniform opposition to the rapidly growing phenomenon of fully electronic, paperless voting. It is not because the computer-science community has suddenly decided that computers are bad. Rather, those who deal with technology daily know that there are risks associated with electronic systems that are not as apparent to those with less experience.

Even limited exposure to computers, however, gives some appreciation of the dangers. Who hasn't lost data because of corrupt files? Who hasn't experienced a hard-disk failure, or data loss due to an operating-system crash? ``Our computers are down; please call back later,'' is a recognized excuse. We've all heard it.

Unseen failures

When considering voting technologies, it is important to remember that the worst problems we are likely to encounter have probably never been experienced. Advocates for fully electronic, or Direct Recording Electronic, machines say that these systems have never experienced a failure. Unfortunately, regardless of whether this is true, it does not matter. The most horrendous system failures are ones that have never been encountered before.

The question to ask is whether there is a potential for catastrophic breakdown of the system, not whether a particular failure has been experienced. And the answer is that every fully electronic system has that potential.

What happens in the case where the results of an election appear questionable after the fact? Two weeks ago, in Miami-Dade County, Fla., a group of citizens requested copies of the ballot images from the 2002 race for governor where DRE machines were used. The request was prompted by the fact that the number of reported votes was suspiciously lower than the number of people who signed the registers at the polls. At issue was whether the voting machines failed to count some of the votes.

Unfortunately, when officials looked for the data, they discovered that it had been wiped out because of a system crash. For a few days, it seemed that the electronic voting system had faltered. Then, luckily, a CD was found with a copy of the data.

Hidden problems

The lesson from Miami-Dade is not that the CD was found. Rather, it is that electronic data is fragile and easily corrupted or d.

When electronic data is lost, it is not always obvious. Electronic data can change with no visible evidence, which is why the disappearance of the data in Florida was so startling. One cannot tell by looking at a hard disk whether it contains any data. Unfortunately, the leading vendors of DREs exacerbate this lack of transparency by refusing to allow inspection of the code that runs inside the machines.

While the airline cancellations last Sunday were inconvenient to many, post-mortem analysis of the system revealed the cause of the failure, and measures were instituted to decrease the likelihood that the problem will repeat. In an election, there is only one chance to get it right, and the stakes are extraordinarily high. If the system fails on Election Day and votes are lost, d or counted incorrectly, it may be of little comfort if a flaw is identified later.

The haste to adopt electronic voting in this country resulted from the election debacle in Florida in 2000. Poorly designed butterfly ballots and substandard punch cards with hanging, pregnant and dangling ``chad'' resulted in disaster.

But the fact that both of these voting techniques involved paper ballots does not mean that all forms of paper ballots are flawed. The ballot design in West Palm Beach in 2000 and the punch-card systems used in other parts of Florida represent the worst of paper ballot technology. They should be criticized.

But we should not compare DRE voting to the worst paper technology. We should compare it to the best. Our choice should be among the finest of each possible technology, and well-designed optically scanned paper ballots should not be discounted because punch cards are bad.

Paper ballots can be stolen, misplaced or burned. But if proper procedures are employed, it is likely to be obvious when something amiss occurs. There are measures that can be taken to protect paper ballots, including poll-worker training, redundant observers and chain-of-custody tracking.

But even the most experienced computer scientist cannot tell by external observation whether a hard disk has failed or whether a file system is corrupted. When problems occur with paper ballots, they affect the election locally. Software glitches in widely used DREs could affect votes cast on all of those machines.

High risk

Logic and accuracy tests are performed on DREs, but no amount of testing can stress the system the way an actual election does.

In November, more than 30 percent of American voters will use DREs. That is more than a threefold increase over any previous election. A full-fledged election involving an unprecedented millions of people casting votes on DREs is at best, a high-stakes experiment.

Furthermore, testing only helps detect certain classes of problems, which do not include foul play. As long as there has been voting, there has been fraud, and fully electronic systems can be manipulated in imperceptible fashion. In addition, manufacturers of DREs are in a position to rig their machines in unpredictable and undetectable ways.

Ballots should not be invisible. Several states, including California, Nevada and Missouri have realized this and moved toward voter-verified paper. These ballots have tremendous benefits over their electronic counterparts. Having tangible, humanly readable ballots that voters verified before casting protects against unexpected computer failures and malicious tampering or rigging. They also allow for recounts in close or controversial elections.

If we ignore the potential for malfunction and corruption in future electronic voting systems, we may end up some day looking back on Florida 2000 with nostalgia.

AVI RUBIN is a professor of computer science and technical director of the Information Security Institute at Johns Hopkins University. He wrote this article for Perspective.