E-voting machines' confidence gap

By Susan Llewelyn Leach | Staff writer of The Christian Science Monitor 03 October 2004

Imagine your bank teller accepting a deposit and then saying, "Oh, you don't need a receipt. It's all in the computer." On Nov. 2, that's essentially what millions of citizens will be told when they cast ballots on new electronic voting machines. Forty-two states are poised to use this latest technology, but with only 28 days left until the presidential election, some states are still debating whether to provide a paper confirmation of each voter's choices.

Potential problems with electronic voting - and very real mishaps - have gained more public attention in recent months, and manufacturers and election officials have tried to play down concerns. But some state officials have also chosen to build in more safeguards to ensure that the electronic vote data, if corrupted either accidentally or maliciously, have a backup. That means one thing: a paper record.

 Last week, California passed a law mandating a paper trail on all its e-voting machines by 2006. The same week, a federal appeals court revived a Florida lawsuit that requires voter- verified paper ballots on touchscreen machines (although it may not be resolved before Nov. 2), and a number of states are either holding off buying the new machines or weighing whether to essentially ban paperless voting after the presidential election if they already use them.

A suit brought against the Maryland Board of Elections, however, alleging that machines made by Diebold Election Systems could not provide "a secure and accurate vote," was rejected last month.

Even as computer scientists knock heads with vendors and election officials, e-voting critics are wary of introducing new regulations so late in the day.

"There comes a point when I think there are more security risks to starting to change things around than go with what we have," says Aviel Rubin, a computer science professor at Johns Hopkins University, who helped bring the security flaws to light.

What concerns critics is the integrity and accuracy of the vote. In a close race, where recounts might be required, most electronic voting machines could not produce a voter-verified ballot printout. And even without recounts, where the voting appears to go smoothly, there is no way of knowing that e-votes have been correctly tabulated, they say.

Electronic voting made its biggest leap onto the scene after the 2000 presidential election got ensnared in punch cards and dangling chads. The 2002 Help America Vote Act (HAVA), pushed through in the wake of that fiasco, provided $3.9 billion in federal funding for such things as helping states and local governments find alternatives to punch cards.

Although many districts quickly adopted electronic machines as the best option - 50 million voters or a third of the electorate will use them next month - the technology remains controversial. So much so that two bills were introduced to amend HAVA and make a voter-verified paper audit trail (VVPAT) a federal requirement for electronic voting machines. Both bills languish in committee.

A VVPAT would work much like the journal receipt on old cash registers, where a roll of paper under a glass or plastic shield records the transaction. With an electronic-voting machine, the voter would look through a window at their vote printed on paper and verify that it matches what he or she has chosen on the screen before hitting the vote button. That paper would then into a lockbox. In the event of a machine breakdown or recount, separate paper receipts would exist for each ballot cast.

But paper is unnecessary, says Bob Cohen, senior vice president of the Information Technology Association of America (ITAA), a trade group that represents many of the voting machine manufacturers. "What it does is provide a comfort level perhaps to certain voters.... Paper receipts are not a panacea by any means. They introduce a lot of challenges in the administration of elections."

ITAA president Harris Miller writes, in an online article that ballots with several candidates and initiatives can generate receipts several feet long, "delaying, confusing, and frustrating the typical voter." In response, critics cite the successful September primary in Nevada, which used electronic equipment along with paper receipts.

HAVA also requires "a manual audit capacity" for voting machines. And manufacturers say their machines are already in compliance. Diebold Election Systems, the largest supplier of Direct Recording Electronic (DREs) or touch-screen machines in the US, explains on its website that "the image of each and every ballot cast on the voting station is captured, and can be anonymously reproduced on standard paper should a hard copy of ballots be required for recount purposes."

Informed computer scientists respond that if those ballot images are corrupted, either accidentally or intentionally, then all the printouts will be corrupted, too.

"If the bits in the machine are entered incorrectly in the first place, the paper would be completely consistent with the electronic record and they'd both be wrong," says Prof. Peter Neumann, principal scientist at the Computer Science Laboratory of SRI International and an authority on computer-based risks. "Given a machine that has no meaningful audit trail, you have absolutely no assurance that your vote goes in correctly."

To rely exclusively on computer software without the ability to do a ballot-by-ballot recount opens the vote to untraceable errors at best and tampering at worst, scientists contend.

An acute example of that apparent lack of transparency happened in Broward County, Florida, last January. In a special election, where 10,800 or so votes were cast on DREs, the winner squeaked through with a 12-vote margin. The machines, however, also recorded 137 blank votes. That means people went to the polling station, signed in, stood in the booth, but then chose not to vote, which would be particularly unusual in an election with only two candidates. With no paper-ballot backup, a recount was impossible - even though required by law.

Mr. Cohen puts the undercount down to human error. "[Voters] go in and, for whatever reason, they don't vote. I think a lot of things happen in the voting booth that cause the discrepancies."

A key issue for scientists is the proprietary source-code the machines use, which they argue should be made public. This would make it harder for someone to tamper with the machines and would identify potential software flaws or security weak points.

Right now, election equipment must be certified by the state and at the federal level. But a random audit of Diebold machines after the California recall election last October, for example, revealed that none of the machines' software had been certified. In April, the state introduced tougher security measures for e-voting machines.

The most accurate method is still the old hand-counted paper ballot, says Dan Seligson, editor of electionline, an online newsletter on election reform supported by The Pew Charitable Trusts. "But even then you have to trust the counters."