Every voting system includes a key component, called the ballot definition file (BDF), that is never subjected to an outside review. Given that BDFs determine the way votes are recorded and counted, the lack of independent oversight of these files is a major security vulnerability. If BDFs are incorrectly prepared, the wrong candidate could be elected. While BDFs may be data, their data triggers processing logic in the underlying software, so if they are set up incorrectly, they could trigger the wrong processing and alter the outcome of an election.

BDFs are unique for each election and define all the races and candidates for each precinct. BDFs tell the voting machine software how to interpret a voter's touches on a screen or marks on an optical scan ballot (including absentee ballots), how to record those selections as votes, and how to combine them into the final tally.

Programming election data is a very complex process, especially in counties with hundreds of different ballot styles, and a single error can jeopardize the outcome of an election. Some election districts lack the technical expertise to prepare BDFs, and instead depend on the vendor or outside programmers for the preparation. Others prepare the BDFs themselves. In both cases, however, BDFs undergo very little testing and no independent audit before being used to determine the results of an election. Little wonder that many serious election disruptions have been caused by ballot definition errors. Other BDF errors have probably gone unnoticed, and some may have affected election outcomes.

Virtually all of the proven ballot definition errors occurred on optical scan equipment and were caught by a manual recount of the ballots. A few examples:

	67,000 absentee and early-voting ballots were counted incorrectly. (New Mexico, Nov. 2000)
	A difference in ballot data on different machines resulted in miscounts in 18 races. (Texas, April 2002)
	2,642 Democratic and Republican votes were counted as Republican. (Florida, Sept. 2002)
	Victories for two commissioners were initially given to the wrong candidates. (Texas, Nov. 2002)
	5,500 party-line votes, both Republican and Democrat, were uncounted. (North Carolina, Nov. 2002)
	Loss reported for a candidate for County Board of Supervisors was really a win. (Iowa, June 2006.)
Since DREs (electronic voting machines) without an accurate voter-verified paper record provide no way to conduct an independent audit of the results, BDF errors on DREs are virtually undetectable. Given the known problems with BDFs on optical scan voting systems, it is reasonable to assume that similar but undetected errors have also occurred with DREs.
	January 2004, Broward County, Florida. The 134 blank ballots recorded by DREs are still unexplained. Did 134 voters cast blank ballots as election officials assume, or did a BDF error cause votes to be lost as has happened on optical scan machines?
	November 2002, Georgia. Dramatic upsets in the races for Governor and U.S. Senator could not be investigated because the voting machines were DREs. The outcomes may have been correct, but how do we know the BDF was not flawed?

If unexamined BDFs are flawed, a hand recount of the original ballots is the only way to detect the error. Recounting optical scan ballots by running them through the the optical scanner a second time typically shows the same results as the initial tally. But meaningful recounts cannot be conducted for many DRE systems, because there are no original ballots to recount.

Accurate election results require accurate BDFs. Some counties have hundreds of ballot styles, and each one must be programmed correctly since a human error in any definition could be magnified by the number of voters using that ballot.

Pre-election testing is completely inadequate. Optical scanners are tested by running a small set of test ballots — hardly enough to test every possible combination for every ballot style. Testing on DREs ofen involves simply pressing each button on the screen to make sure they all work correctly. Testing has failed to detect many election data errors that have disrupted many optical scan elections. If an error occurs during an election, new data is created and used to tally the final result, but there is no way of knowing if the new data is correct.

The extreme complexity of election definition data, the complete lack of security procedures used to create them, the hopelessly inadequate testing: these problems raise serious questions about the accuracy of electronic vote counting — on both DREs and optical scanners.

Furthermore, in order to ensure the accuracy of ballot data, an independent review must be performed on every BDF for every election in every voting district for as many years as the machines are in use. Since each election-specific BDF is created immediately before each election, both the time constraints and the costs are significant.

Detailed reference information about ballot programming.