Wallach: Texas must confront voting systems' flaws
Dan Wallach, RICE UNIVERSITY
Austin American-Statesman

Thursday, September 02, 2004

Our state's election officials support the most fundamental pillars of our democracy. They ensure that our votes are counted with enough transparency and robustness to convince all parties that an election outcome is correct.

Unfortunately, the Direct Recording Electronic (DRE) voting systems that are used in a number of Texas counties, including Travis, do not fulfill these basic needs. Work I did last year at Rice University, along with colleagues at Johns Hopkins University, jump-started this concern by pointing out major flaws in one vendor's system. Other researchers have confirmed our findings.

When voters can cast multiple votes and election insiders can tamper with election results with stunning ease, it's clear that our voting systems are inadequate.

Despite these well-known design flaws in DRE voting systems, vendors and election officials continue to assure us that their systems are "certified." Unfortunately, the current standards for voting systems, which DRE systems are certified to meet, say nothing about how these machines should be engineered to resist tampering and little about the general quality of the software. As a result, vendors are allowed to sell voting systems that would not come close to the software engineering standards for aircraft controls, banking or even gambling machines.

Many people also would be surprised to know that the certification of our voting systems happens in secret. The "independent testing authorities" who examine them are bound by non-disclosure agreements with the vendors; we never learn what their testers uncover. Likewise, Texas' own examinations happen behind closed doors, a practice that may violate state laws.

Requests made through Texas' Open Records Act to disclose these findings have yielded superficial reports that indicate a lack of time and resources spent on the examination. So we have little evidence to support election officials' claims that DRE systems are meaningfully secure.

How can these systems fail? The votes are recorded on memory cards similar to the ones used in digital cameras. These cards can be easily corrupted, either through software bugs or tampering. Such corruption would not necessarily be detected by the minimal "logic and accuracy" testing before elections.

How else should we vote? The best technologies on the market are precinct-based optical scan systems, where voters are given printed paper ballots and fill in the bubbles with a pen. A scanner mounted above the ballot box will reject over-voted ballots and will even refuse to allow multiple ballots to be stuffed in at the same time.

These systems have been shown to have consistently lower under-vote rates, implying higher accuracy and more voter comfort with the simple pen-and-paper approach. Most importantly, optical scan systems provide a paper trail. Voters can see and verify the permanent record of their votes. If something goes wrong, those original paper records will be used to recount the election.

What about accessibility? The Help America Vote Act mandates that every precinct have at least one accessible voting system by 2006. DREs are not the only systems that can satisfy this requirement. Computer-assisted ballot marking devices have a DRE-like computer interface but print onto standard optical scan ballots. Such systems cost far less money than an all-DRE solution, while preserving the verifiability and transparency of paper ballots.

How does Texas compare nationally? Other states have been far more active than Texas in studying the problems associated with DRE systems. Maryland and Ohio have commissioned detailed independent studies by security experts. Nevada and California are adopting requirements that electronic voting systems must print paper ballots that voters will verify. Texas should take similar steps.

What can we do to protect our votes? Several Texas counties use DRE systems for early voting and optical scan systems on Election Day. Voters in those counties can choose to vote on Election Day, creating a permanent record of their vote. Other counties should follow the recommendations of a recent report from the Leadership Conference on Civil Rights, which defines detailed policies and procedures to minimize the risks inherent in DRE systems.

Of course, everybody should vote this November and in every election. It's better to vote on a flawed machine than to stay home. Our election officials should take the integrity of our votes seriously and start taking appropriate steps. Our democracy deserves nothing less.

Wallach is an assistant professor in the Department of Computer Science at Rice.