By Lambert Strether of Corrente.
As readers know, I’m a big fan of paper ballots[1], and the recent Election in Virginia gives me a chance to explain why. (The “recount” phase — erroneously named, as what’s been happening is resolving absentee and provisional ballots — seems to have culminated with the Republicans keeping control of the Virginia House by a whisker, 49-51.) First, I’ll do that, and set up two requirements that any system for counting votes in a democracy should meet. Then, I’ll look at Virginia’s “Back to the Future” transition from digital voting to paper ballots.
From Brad Friedman’s essay on “Democracy’s Gold Standard” (with numbering added), a set of requirements for voting systems suitable for a democracy:
Last March, the country’s highest court found that secret, computerized vote counting was unconstitutional. Unfortunately, the country was Germany, and the Constitution violated by e-voting systems was the one that the U.S. wrote and insisted Germans ratify as part of their terms of surrender following WWII.
Paul Lehto, a U.S. election attorney and Constitutional rights expert, summarized the German court’s unambiguous, landmark finding:
- “No ‘specialized technical knowledge’ can be required of citizens to vote or to monitor vote counts.”
- There is a “constitutional requirement of a publicly observed count.”
- “[T]he government substitution of its own check or what we’d probably call an ‘audit’ is no substitute at all for public observation.”
- “A paper trail simply does not suffice to meet the above standards.
- “As a result of these principles,…’all independent observers’ conclude that ‘electronic voting machines are totally banned in Germany’ because no conceivable computerized voting system can cast and count votes that meet the twin requirements of…being both ‘observable’ and also not requiring specialized technical knowledge.
If you go through this set of requirements, you’ll see that hand-marked paper ballots, hand-counted in public, meet every one of them. You will also see that digital voting systems, no matter how designed or implemented, cannot. They cannot, especially, meet requirements #1 (“no specialized technical knowledge… to monitor”) and #2 (“a publicly observed count”). The first requirement ensures that the voting process is not riggable by insiders with technical expertise (native, or hired); the second ensures that the actual voting is not rigged on election day. These are important requirements for a functioning democracy.
And that is how Germany conducts its voting today, from Deutsche Welle (“German election: Volunteers organize the voting and count the ballots”).
Public observation:
On September 24, hundreds of thousands of volunteers will be handing out ballots, checking voters’ names against lists, and counting votes once the polling station closes. The entire process is open to the public… Every citizen is allowed to watch and monitor the entire counting process; and in effect, the volunteers monitor each other.
No specialized technical knowledge:
[T]he volunteers open the ballot box, take out the envelopes and remove the ballot slips. They sort the ballots according to a pre-arranged system, decide on whether the votes are valid or invalid, and count the votes – reading out each vote aloud, which is noted in writing in a log.
At the end, the number of ballots is compared with the number of people who voted in that particular polling station.
Does that sound technical to you? The United Kingdom and Canada[3] also use handmarked paper ballots, counted in public, as do most[4] other countries. Many nations have — I don’t want to use the word “reverted” — come home to paper ballots after experimenting with digital systems and finding them wanting; so have some states in this country.
Now, let’s turn to Virginia. It’s worth noting that Virginia’s move back to paper is being applauded across the political spectrum. From the centrist Daily Banter, a summary of the history:
It wasn’t until 2014, when the state experienced a myriad of problems on Election Day, that Governor Terry McAuliffe proposed an overhaul of the state voting system. By 2015, the Virginia Board of Elections decertified the use of WINVote, but they were still stuck with other DRE (Direct Recording Electronic) systems. This past summer, at a DefCon conference in Las Vegas, computer scientists staged a “Voting Machine Hacking Village” to prove the instabilities of DRE, which included a single password for all machines, physical ports to insert malware, and reliance on outdated software that had not been updated since the mid-2000s.
(Kudos, amazingly enough, to McAuliffe, who also managed to restore the franchise to felons.) The Richmond Times-Dispatch explains the Board of Elections’ reasoning:
In emergency meeting, Virginia elections board votes to scrap all touch-screen voting machines
The Virginia State Board of Elections voted Friday to discontinue use of all touch-screen voting machines throughout the state because of potential security vulnerabilities, forcing 22 cities and counties to scramble to find new equipment just weeks before voting begins for the November gubernatorial election.
Behind closed doors at an emergency meeting in Richmond on Friday afternoon, the board heard about specific vulnerabilities identified after a cybersecurity conference this summer in Las Vegas, where hackers showed they could break into voting machines with relative ease.
In an interview, Elections Commissioner Edgardo Cortés acknowledged that the short time frame could put localities under the gun. However, 10 of the 22 localities that still use touch screens, either as their primary voting method or for more limited uses, have already begun buying new equipment, Cortés said. That leaves 12 that will have to start from scratch, but Cortés said the rapid swap is “doable” and worth the “hiccups” that may come with new equipment.
(The Banter points to “Russian targeting of last year’s presidential election” (whatever that means) as do others, but if the threat of Russia hacking was a necessary cause for the Board’s decisionl, it was certainly the DefCon that was the proximate one).[2] In any case, the Board’s decision was taken September 8, and by Election Day, November 7, the transition was complete with no reported problems, which shows you the advantages of adopting simple, rugged, and proven systems. Here is how the system works, as described in a press release from Albemarle County:
The Albemarle County Department of Voter Registration and Elections wants to alert voters that a new, digital scan voting system will be used in all County voting precincts in the upcoming November 3, 2015 general election. The previously used “touchscreen” voting machines have been replaced by the new voting systems as a result of the Commonwealth of Virginia’s mandate which requires jurisdictions move toward the use of digital scan technology.
With the new system, voters will mark paper ballots at marking booths, and then deposit the marked paper ballots into a digital ballot scanning machine, which will read the ballots, and drop them into a secure ballot storage bin. When the polls close on Election Day, at 7 PM, the election officers at the voting precincts will obtain the tabulated totals of votes from a results report that will be printed by the digital scanning machine. After the election, the paper ballots will be kept in secure storage for a period of one year, to ensure a voter-verified paper trail in the event of a recount.
Recall our two requirements. Can the Virginia System be said to meet them?
1) Public observation. Yes and no. Yes, because the ballot is handmarked, and dropped in the box in public. No, because the ballots are counted in the innards of the optical scanner. (This can be mitigated by storing the ballots for recounts later, if needed.) And no, because the actual running of the count from the scanners does not take place in public, nor (AFAIK) the integration into the totals of provisional and absentee ballots.
2) No specialized technical knowledge. Yes and no. Yes, because clearly paper ballots are an improvement in every way from the horrid touch screens. No, in the same that once again, the innards of the optical scanner must be relied upon. (This could be mitigated, depending on the choice of vendor, by dealing with an actual scanner industry, as opposed to a bunch of tiny, sketchy outfits purveying custom, proprietary software.)
In summary, and IMNSHO, there should be no digital determination or intermediation of voter intent whatever; why should we trust the scanner software engineers, or those who run them? There’s no reason to, any more than there’s reason to trust the engineers or operators of mechanical voting machines.) Virginia’s ballots are indeed hand-marked, but they are not hand-counted in public.[5]
With these strong caveats, Virginia’s hand-marked paper ballots were well-received by the public, and that’s progress. WAVY:
At a voting precinct at the Chrysler Museum in Norfolk, voters said they had no issues going back to pen and paper.
“It goes back to the old days, you know, we’ve been voting a long time, so we remember when they didn’t have anything but paper ballots,” said voter Winston Whitehurst.
Voter Kevin Rafferty said he enjoyed the switch.
“It works. I understand. At least if we’re having to spend some time on it, we’re the only ones in control, perhaps is the idea. Nobody else hacking on in I guess is their theory so hopefully it’s safe,” he said.
And WTVR:
“You can’t hack paper,” a man training a group of Hopewell poll workers on the new [optical scanning] machines said.
(But you can hack the scanners — using “specialized technical knowledge” —
and you can social engineer any process where the ballots are not hand-counted in public.)
Conclusion
Of the two requirements, the ability to monitor election results without technical expertise is needed to prevent chicanery by those who structure the voting process. And the public count is needed to prevent chicanery on election day by those who inspect and count the ballots. Paper ballots can and do meet these requirements. That’s why most Western countries use them, and why many other countries have returned to them, after experimenting with digital systems. Virginia’s re-adoption of hand-marked paper ballots is a step forward, not backward.
NOTES
[1] For those who are concerned that paper ballots prevent ranked choice voting, Maine advocates disagree: “Ranked choice voting is designed to work with paper ballots.”
[2] The idea that “foreign invaders” (as the Christian Science Monitor puts it) are the main threat for election theft seems very odd to me. Surely domestic operatives are, or at least should be, the main concern?
[3] I vividly recall a Quebec referendum where the Quebec “scrutineers” rejected a seemingly overlarge number of “No” ballots. But because the process was public, and not part of an algorithmic black box, the scrutineers could be called out. Although Canada does use electronic voting at the municipal level, the stakes are lower.
[4] Hilariously, a Google search on “How many countries use paper ballots” directs me to a WikiPedia page on “Electronic voting by country.” 26 are listed. There are 195 countries.
[5] The convenience of election officials seems to bulk large in these disucussions; they don’t want to be “up all night counting paper.” Well, if the Germans (and the Canadians (and the Brits)) can make that investment in democracy, why can’t we?
27 comments
Comments are closed.
Just an added note here to say that in Ireland, which uses Single Transferable Vote, the law states that the election candidates can appoint Counting Agents, known as Tallymen during the vote. They observe the opening of voting boxes and keep a tally during the count. As this allows them to get a good feel for voting patterns, it eliminates another potential source of fraud, box stuffing during or after the vote.
The Tallymen are so skilled they can often provide a very accurate result hours before the final result (vote counting is much more complex for STV). There is no interest at all from political parties for electronic voting because tally information is more fine grained than final totals (as it is box by box rather than district by district) and so provides each party with very valuable statistical information.
Same in Canada but we call them “scrutineers” or monitors (at least in Ontario). I worked as an election official a while back (I think it was at the last provincial election) and one of the scrutineers raised a big stink because the number of votes were not the same as the number of people who voted. I left around 10 pm and I heard they were there until midnight trying to resolve this. It was pure schadenfreude for me because I wasn’t selected as one of the vote-counting electoral officials but was just a lower-paid electoral assistant who barred people from entering the building from the wrong door and gave directions to the correct entrance. “Serves those idiots right for not picking me” was what I was thinking when I left.
In France, the process is basically the same as in Germany. An interesting note, that I don’t see mentionned, is that once the public count is done and the number of votes matches the number of voters, ballots are destroyed (except blank votes). A very sensible step as the whole process is fraud-proof and ballots could be tampered with afterwards.
In this sense, there are no recounts (except the basic maths check). You can only report to the courts irregularities in the process and there will be a new election if enough polling station were affected to swing the election.
And the process is generally not too long. The average seems to be between one and three hours so it’s almost always done way before midnight (British seems to take a very long time, if anyone cares to explain to me why ?). Of course, it helps a lot that we don’t elect a whole bunch of people on the same night (no lieutnant-governor, judges, sheriffs…), it’s always one election at a time with a dozen choices at most (and half the time it’s only two because of the two-round system).
Having used a number of different systems as I moved around the state of Maryland*, my favorite system was hand marked ballots that were scanned by machine at the voting place. My observations follow.
Old fashioned lever machines: They haven’t made them for years, so there was always a shortage of machines which led to long lines. Despite the fact that people are familiar with them, they are an un-auditable black box like electronic voting machines.
Punched card machines. They always seemed physically a little difficult to operate and a slight misalignment could result in a miscast vote. But there is a recountable paper trail and only one or two scanners is required for each polling place.
Electronic voting machines. They’re a completey un-auditable black box. They DO have the advantage of being easier to adjust for people with limited vision and other handicaps. Each voting station requires a separate machine, which means either greater expense or longer lines compared to other systems. My guess is that programming the ballots into them probably costs almost as much printing ballots and is more difficult to spot errors or fraud.
Hand counted ballots: The difficulty with hand counting ballots is that it is error-prone and slow.
Paper ballots and digital scanners would seem to be the best system that I have used with several caveats. You have to manually recount a random sampling of polling places to check for systemic fraud in the setup of the scanning machines. You have to have a good system to deal with errors and complications. How do you void ballots that have been mis-marked by accident? You have to make SURE that they aren’t added to the tallys. You have to have a system for contested/contingent voting, a way to segregate and maintain those ballots until the eligibility of the voters is determined.
*It used to be that every county chose the vote system separately
That is an excellent suggestion however getting officials on board is not so easy. Our state got new optical scan machines in all larger precincts a few years ago and since they had never been used I made the same suggestion you did to our city council and asked for a random audit. They refused and told me that by state law the city was not allowed to do an audit just because they felt like it and the only way a recount could be done was if an election was close enough to be within the mandated threshold needed to trigger one. If they were correct about our state law, the state has actually made it illegal for cities to check the accuracy of the machines they use. That would need to be changed in order for your proposal to work.
I do still prefer handcounted paper ballots – I did get to participate in a hand recount eventually and it was a LOT quicker than you might expect.
The other issue is cost – it would be a LOT cheaper to pay people to count by hand than to replace millions of large pieces of aging machinery every decade or so.
Maybe, but machines can’t determine voter intent on paper ballots nearly as well as humans can. Our city uses these optical scanners and as noted last election season, we had a close race that triggered a recount that I participated in. The human beings actually counted more ballots than the machines did, as the machines didn’t count those that were filled out improperly (circles not completely filled out, or checked rather than filled in, etc). Rough estimate, we were able to count approximately 2% more votes then the scanner did.
If we’re going to keep pretending we still have a democracy here in the US, everybody’s vote deserves to be counted in every election. The only way to do that is count paper ballots by hand.
The FIRST TIME I heard that they were going to use IT technology for voting I thought they must be kidding. It is so obviously wrong ON THE FACE OF IT that I have always suspected the motives of those making that decision (although I suppose I should´t be too surprised at human laziness being a motivating force!). Anyway, it is to me just another sign of the dumbing down of America that this whole topic needs any discussion at all!!
…Voltaire would have loved political position that the machines were perfect and unable be hacked until Chavez-Venezuela bought voting machine manufacturer…
suddenly voting machines were suspect…
Clinton conflates Virginia’s switch to paper ballots with her claims that Russia hacked into voter rolls and possibly went even further. This is Clinton speaking about it on Monday at the Atlanta stop on her book tour.
So maybe we’re finally getting some benefit from the claims that the Russians were able to manipulate the election results in the United States! In reality, it’s Republicans and Democrats who manipulate election results in the U.S., but I’ll accept a victory, even if it’s for the wrong reasons.
Exactly! Clinton applauds the reduced risk of paper ballots, but of course has to muddle it all up with the dreaded Russian threat. I swear, Clinton can’t help but link almost everything to Russia now — listening to her is like plaing a constant game of 6 degrees of Kevin Bacon, except it’s 3 degrees and its Russia.
She’ll continue to play six degrees of Kevin Bacon for the rest of her life–with egg on her face the whole time.
One would think that governments would require that any software to be used in a public election must be open source – not proprietary – and that it and its application be open to public audit.
Vendors unwilling to comply can take their sales people elsewhere. If vendors are hard to find, governments could join together in providing seed money for any number of parties to develop and maintain the necessary code.
This is the sort of change that should be part of any elections improvement commissions, not that the likes of Kris Kobach and his commission have in mind anything but voter suppression. The use of proprietary software in a public election is as appropriate as a cordon of watch dogs, lighted torches, or police cars outside a voting center.
This. And why don’t we turn the students at state run universities loose on it?
Long time software engineer here.
“Making the source code available” for a critical system makes a good sound bite, but in reality has a number of substantial problems:
o There is no guarantee that the compiled code in the box is the same as the purported source code made public. Even technical experts would have a very hard time confirming this, since the code in the box has been compiled down to machine instructions whereas the source code is normally in a high level language.
o The process of building (compiling and linking) the code introduces myriad opportunities for bad actors. E.g., code can include conditional sections or definitions that can be built in various ways. The build process itself invokes other programs that themselves can be hacked. Building also normally brings in third-party libraries of uncertain provenance, and for which the source is typically unavailable.
o Inspecting realistic industrial software for *inadvertent* problems, called a code review, is a big effort (many man weeks) and requires people with the requisite skills (often arcane) and expertise in the problem domain. Inspecting code for *deliberate hacks* would be much harder, and could well miss hacks anyway depending on the skill of the hacker.
Relying on public source code for security is a very weak reed and should be avoided altogether if at all possible.
Fair enough. But why would proprietary code be better? I mean what stops a private vendor from doing this, but without public oversight? I mean to say “public code” in what ever form could be a start.
XXYY was not supporting proprietary code. I believe he was pointing out that “open source” does not have sufficient integrity for e;ections, thus closed source (proprietary code) is worse.
Also a software engineer :-)
The risk of errors in the compiler, operating system, etc., can be mitigated by using OSS (open source systems) for the entire stack (probably with some digital fingerprinting too). And using Open source as suggested by EoH means that you are getting much more than a one-time code review — the system is constantly available for review, and I expect the likes of the folks at Defcon would be reviewing it.
While this still leaves verification of the system(s) in use to those with “specialized technical knowledge”, that knowledge is at least wide-spread, not limited to a particular organization (or a particular political point of view).
I can see the argument for paper ballots. But I do think it is possible to create technical systems that are relatively safe, if the creation is public.
And the underlying code from the manufacturer may very well be fine, the setup for the individual election and polling place may be fraudulent.
After the 2000 election, congress passed the Help America Vote Act (HAVA). Among the provisions of the bill, money was given to states and counties to upgrade their voting systems. Most of these new systems came online in the mid 00’s.
Now that it has been around a decade, the generation of machines purchased with the help of federal money are getting long in the tooth. The average person changes their cell phone every 2-3 years, so a touch screen machine machine over a decade old feels especially ancient to a technophile.
There will be a trend toward paper ballots with this next generation. More states have added tougher paper trail requirements on DRE (touch screen) voting machines. and there is a lack of federal HAVA money available to states and counties to buy top-of-the-line DRE machines with paper trails. Vendors for this generation are pushing hybrid systems that allow a voter to input their choices onto a touch screen, then the machine prints out a paper ballot which (theoretically) removes ambiguous choices and allows disabled people to vote without assistance. But ultimately, if a jurisdiction is going to a paper system anyway, why spend more money on expensive hybrid machines that will break down in another ten years? I anticipate a push to paper ballots with optical scanning tabulation machines in the medium future.
…and states can – do take away driver licenses – I.D. “legally” determining who gets to vote, by the hundreds of thousands, even over issues having nothing to do with driving, and primarily affecting the poor:
https://www.washingtonpost.com/news/storyline/wp/2014/10/22/4935/?utm_term=.604ea869bedb
https://www.theguardian.com/commentisfree/2017/nov/10/america-punish-poor-debtors-drivers-license-suspension
http://www.jwj.org/these-two-states-will-revoke-your-license-if-you-cant-pay-back-your-student-loans
http://www.ncsl.org/research/human-services/license-restrictions-for-failure-to-pay-child-support.aspx
Minneapolis uses ranked choice with hand marked paper ballots that get scanned just like VA. But as I’ve said a million times ranked choice voting is bad for 3rd parties. Approval, range, or 3-2-1 are all much better options.
http://electology.github.io/vse-sim/VSEbasic/
What is the rush? Why not start counting at 8 am the next morning? The all night vote count thing serves no functional purpose. Get some sleep.
What is the rush?
In my town, we have big election night parties at the downtown bars while volunteers go to the polling stations and phone back the preliminary results which are posted in the front windows or on the front doors.
A lot of politically connected people would have trouble sleeping the night of the election if they didn’t have the results.
That was my initial reaction too. Then I wondered: who will be guarding the ballot boxes overnight?
In my town’s municipal election last week, it seems almost a tenth of voters were confused by the design of the ballot and circled their choice rather than filling in the bubble.
Since we’re in Massachusetts and all elections use Scantron ballots and tabulating machines, any circled ballot was marked “blank” the same as ballots where no notation was made.
A lot of people, including quite a few first-time and infrequent voters, and voters with eyesight issues, were disillusioned by the fact that their votes would not be counted. Some were shocked the ballots are not in fact counted by hand.
No one has mentioned that this is an extension of the standardized testing grift in education. Scantrons aren’t the best way to measure student knowledge. But they do allow politicians to steer public capital to politically connected vendors (who just so happen to make campaign donations), thus allowing the substitution of capital for labor. Who wants to hire teachers to grade essay exams when there’s no corporate lobbyists selling teachers in the capitol?