The items above that primarily demonstrate a concern for computer security are (2), (5), (6), and (7), while items (1) and (4) refer to assurance of accurate calculation and reporting of the election results. From the very first, the question of computer security would dominate application of resources to assure integrity, even though implementation of audits would reduce reliance on computer security to provide total assurance of accurate reporting of outcomes.
The distinction between assurance of accurate calculation and reporting of the election results and the assurance of computer security may be described with an analogy. Consider a vehicle carrying a load of goods from seller to buyer. The assurance of the vehicle's safe arrival at its destination is the result of adequate maintenance by its mechanics and safe navigation by its driver. Hiring criteria for these individuals should have included competence and honesty. However, the safe arrival of the vehicle is not the end of the transaction. The goods must be examined to assure that they are exactly those ordered and that they have arrived in good condition. The vehicle is analogous to the specialized computer on which the election application runs, and the assessment of the goods upon arrival is the equivalent of an audit of the election.
The demand since 2003 for "paper trails" for DREs does not fully reflect the total requirements for assurance of the accurate reporting of election outcomes for those machines. A paper trail is a printout from a DRE of the choices made by a voter, and is to be reviewed and approved by the voter as the last step of the voting process. See Section 9 below for a more complete discussion of paper trails, including their disadvantages.
4. Inclusion of Electronic Audit Trails in Designs of DREs
In the design of mechanical lever machines, overvotes are prevented by mechanical interlocks, not possible with voter-filled-out ballots without the assistance of computerized ballot-sensing at polling stations. However, an important and negative feature of lever machines is that no audit trail is retained. An audit trail is defined here as the retained sets of votes cast by all voters. The identity of each voter is divorced from the set of votes cast because state laws generally require a secret ballot. In use of a lever machine, after the voter completes selections and opens the privacy curtain (which causes the levers to return to their neutral positions), no record of the voter's individual choices remains. The voter's selections are added to the values in respective arithmetic counters storing the total count for each candidate, and only each candidate's running sum of votes is stored. HAVA requires, in section 301(a)(2)(A), that "In general ??? the voting system shall produce a record with an audit capacity for such system." This statement appears to imply that that mechanical lever machines are no longer lawful for use in federal elections.
DRE machines were originally designed to simply replace the mechanical operation of lever machines with electrical and/or electronically operating components, thereby continuing the prevention of overvotes and any question of "intent of the voter." However, by the time DREs were being developed, magnetic digital storage was possible. An improvement to the new type of machine was proposed:
"Some assurance of the machine's correct operation ... may be achieved by the retention, in a more permanent form, of the set of each individual voter's choices that are determined by the machine. These voter-choice sets have to be retained in randomized locations so that no set of choices can be traced to a particular voter. ... The sets of voter choices on a particular DRE machine may be summarized on an independent DRE machine or general-purpose computer for verification.
"With DRE machines, no independently created ballots are available for verification of correctness of both ... precise recording of the expression of each voter's choices, and accurate summation of all voters' choices to yield final results. Stored voter-choice sets may be used to verify only the latter of these two steps. The machine-produced recording of the expression of each voter's choices is not independent of the machine process that produced it. The machine cannot be used to independently verify its own correctness" (Saltman, 1988, pp. 41-42). [Emphasis in the last sentence added here.]
The requirement for inclusion of voter-choice sets in DRE design was contained in the first set of national voluntary standards produced by the FEC in 1990. In that document, they are called "electronic ballot images (EBIs)." Apparently, the inclusion of EBIs with DREs is acceptable under HAVA to meet the requirements for an audit trail. The printout of the EBIs following the close of polls and the ability of their records on magnetic disk to be recounted on another computer system appears to satisfy the needs of current law. However, much of the citizenry who work with computers professionally are not satisfied with the law as currently interpreted.
5. Concern Rises over Use of DREs without Paper Trails
Despite their increasing deployment in US elections in the last quarter of the 20th century, there was no significant opposition to the use of DREs until 2003. In 2000, this type of voting device was used by about 13% of US voters, although none were used in the Florida presidential election of that year. By the 2002 federal election, their use had increased to 22% of the electorate (Brace, 2004). The growth was due, in large measure, to the recognition that the "intent of the voter" problem that had been clearly demonstrated in the Florida fiasco could be prevented with use of a voting device that did not employ ballots.
One may speculate as to why extensive opposition arose only in 2003. One possible answer is that many of the first DREs were operated by push-buttons or micro-switches and showed the entire ballot on the machine's surface. These had a similar appearance to their lever-machine predecessors. Lever machines had been used for many years without paper trails, as pointed out above and, while their deployment had decreased, they were still used by 15% of voters in 2002.
In the middle 1990s, a type of DRE using touch-screens was developed. With the use of this kind of DRE, the ballot was not made visible all at once, but had to be seen on a succession of screens. One possible source of concern may result from a drift in the voltage that reports to the computer program where a finger is touching the screen. On rare occasions, a slight change in voltage may cause a touch to be recorded as selection of a different candidate than desired by the voter. While the voter can see this error and easily correct it, it may be disconcerting and generate suspicion of malicious intent. Additionally, these machines have an appearance more similar to personal computers than other types of DREs, and most personal computers are often connected to the Internet. Around 2000, there were experiments of voting over the Internet. Examples of this were the Arizona Democratic and Alaska Republican primaries of that year. Widely publicized Internet hacking incidents that affected computer systems of large private businesses and government agencies raised fears that touch-screen DREs could be similarly impacted. (No connection of a DRE to the Internet is known to this author, but that reality may not be understood by much of the concerned public.)
It appears that many members of the public want something, if not a ballot, that they can touch in order to obtain proof that their votes have been cast exactly as intended. Persons who use ATM machines and those who buy gas at pumps by inserting a credit card in a slot can get a receipt. Voters seem to be asking: why can't we get something similar?
In October, 2002, use of DREs got a boost with the passage of HAVA. In Section 301(a)(3), the law states:
The voting system [used in an election for federal office] shall--
(A) be accessible for individuals with disabilities, including nonvisual accessibility for the blind and visually impaired, in a manner that promotes the same opportunity for access and participation (including privacy and independence) as for other voters.
The distinction between assurance of accurate calculation and reporting of the election results and the assurance of computer security may be described with an analogy. Consider a vehicle carrying a load of goods from seller to buyer. The assurance of the vehicle's safe arrival at its destination is the result of adequate maintenance by its mechanics and safe navigation by its driver. Hiring criteria for these individuals should have included competence and honesty. However, the safe arrival of the vehicle is not the end of the transaction. The goods must be examined to assure that they are exactly those ordered and that they have arrived in good condition. The vehicle is analogous to the specialized computer on which the election application runs, and the assessment of the goods upon arrival is the equivalent of an audit of the election.
The demand since 2003 for "paper trails" for DREs does not fully reflect the total requirements for assurance of the accurate reporting of election outcomes for those machines. A paper trail is a printout from a DRE of the choices made by a voter, and is to be reviewed and approved by the voter as the last step of the voting process. See Section 9 below for a more complete discussion of paper trails, including their disadvantages.
4. Inclusion of Electronic Audit Trails in Designs of DREs
DRE machines were originally designed to simply replace the mechanical operation of lever machines with electrical and/or electronically operating components, thereby continuing the prevention of overvotes and any question of "intent of the voter." However, by the time DREs were being developed, magnetic digital storage was possible. An improvement to the new type of machine was proposed:
"Some assurance of the machine's correct operation ... may be achieved by the retention, in a more permanent form, of the set of each individual voter's choices that are determined by the machine. These voter-choice sets have to be retained in randomized locations so that no set of choices can be traced to a particular voter. ... The sets of voter choices on a particular DRE machine may be summarized on an independent DRE machine or general-purpose computer for verification.
"With DRE machines, no independently created ballots are available for verification of correctness of both ... precise recording of the expression of each voter's choices, and accurate summation of all voters' choices to yield final results. Stored voter-choice sets may be used to verify only the latter of these two steps. The machine-produced recording of the expression of each voter's choices is not independent of the machine process that produced it. The machine cannot be used to independently verify its own correctness" (Saltman, 1988, pp. 41-42). [Emphasis in the last sentence added here.]
The requirement for inclusion of voter-choice sets in DRE design was contained in the first set of national voluntary standards produced by the FEC in 1990. In that document, they are called "electronic ballot images (EBIs)." Apparently, the inclusion of EBIs with DREs is acceptable under HAVA to meet the requirements for an audit trail. The printout of the EBIs following the close of polls and the ability of their records on magnetic disk to be recounted on another computer system appears to satisfy the needs of current law. However, much of the citizenry who work with computers professionally are not satisfied with the law as currently interpreted.
5. Concern Rises over Use of DREs without Paper Trails
Despite their increasing deployment in US elections in the last quarter of the 20th century, there was no significant opposition to the use of DREs until 2003. In 2000, this type of voting device was used by about 13% of US voters, although none were used in the Florida presidential election of that year. By the 2002 federal election, their use had increased to 22% of the electorate (Brace, 2004). The growth was due, in large measure, to the recognition that the "intent of the voter" problem that had been clearly demonstrated in the Florida fiasco could be prevented with use of a voting device that did not employ ballots.
One may speculate as to why extensive opposition arose only in 2003. One possible answer is that many of the first DREs were operated by push-buttons or micro-switches and showed the entire ballot on the machine's surface. These had a similar appearance to their lever-machine predecessors. Lever machines had been used for many years without paper trails, as pointed out above and, while their deployment had decreased, they were still used by 15% of voters in 2002.
In the middle 1990s, a type of DRE using touch-screens was developed. With the use of this kind of DRE, the ballot was not made visible all at once, but had to be seen on a succession of screens. One possible source of concern may result from a drift in the voltage that reports to the computer program where a finger is touching the screen. On rare occasions, a slight change in voltage may cause a touch to be recorded as selection of a different candidate than desired by the voter. While the voter can see this error and easily correct it, it may be disconcerting and generate suspicion of malicious intent. Additionally, these machines have an appearance more similar to personal computers than other types of DREs, and most personal computers are often connected to the Internet. Around 2000, there were experiments of voting over the Internet. Examples of this were the Arizona Democratic and Alaska Republican primaries of that year. Widely publicized Internet hacking incidents that affected computer systems of large private businesses and government agencies raised fears that touch-screen DREs could be similarly impacted. (No connection of a DRE to the Internet is known to this author, but that reality may not be understood by much of the concerned public.)
It appears that many members of the public want something, if not a ballot, that they can touch in order to obtain proof that their votes have been cast exactly as intended. Persons who use ATM machines and those who buy gas at pumps by inserting a credit card in a slot can get a receipt. Voters seem to be asking: why can't we get something similar?
In October, 2002, use of DREs got a boost with the passage of HAVA. In Section 301(a)(3), the law states:
The voting system [used in an election for federal office] shall--
(A) be accessible for individuals with disabilities, including nonvisual accessibility for the blind and visually impaired, in a manner that promotes the same opportunity for access and participation (including privacy and independence) as for other voters.
Next Page 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
(Note: You can view every article as one long page if you sign up as an Advocate Member, or higher).
