(NOTE: Santa Clara County is in the heart of Silicon Valley and is the home of Stanford University. Recently 100+
scientists endorsed the following resolution and postponed the purchase of electronic voting machines for the county.
See... Security of e-vote machines targeted for a report on the decision of the County supervisors. The resolution below comes from: http://verify.stanford.edu/evote.html
Resolution On Electronic Voting
FOR THE LIST OF ENDORSEES OF THIS STATEMENT SEE…
Introduction
As a result of problems with elections in recent years, funding is being made available at all levels of government to
upgrade election equipment. Unfortunately, some of the equipment being purchased, while superficially attractive to both
voters and election officials, poses unacceptable risks to election integrity - risks of which election officials and
the general public are largely unaware.
We are in favor of the use of technology to solve difficult problems, but we know that technology must be used
appropriately, with due attention to associated risks. For those who need to upgrade, there are safe, cost-effective
alternatives available right now, and the potential for vastly better ones in the future. For these reasons, we endorse
the following resolution:
"Computerized voting equipment is inherently subject to programming error, equipment malfunction, and malicious
tampering. It is therefore crucial that voting equipment provide a voter-verifiable audit trail, by which we mean a
permanent record of each vote that can be checked for accuracy by the voter before the vote is submitted, and is
difficult or impossible to alter after it has been checked. Many of the electronic voting machines being purchased do
not satisfy this requirement. Voting machines should not be purchased or used unless they provide a voter-verifiable
audit trail; when such machines are already in use, they should be replaced or modified to provide a voter-verifiable
audit trail. Providing a voter-verifiable audit trail should be one of the essential requirements for certification of
new voting systems."
We elaborate below.
The Problem
In response to the need to upgrade outdated election systems, many states and communities are considering acquiring
"Direct Recording Electronic" (DRE) voting machines (such as "touch-screen voting machines" mentioned frequently in the
press). Some have already acquired them. Unfortunately, there is insufficient awareness that these machines pose an
unacceptable risk that errors or deliberate election-rigging will go undetected, since they do not provide a way for the
voters to verify independently that the machine correctly records and counts the votes they have cast. Moreover, if
problems are detected after an election, there is no way to determine the correct outcome of the election short of a
revote. Deployment of new voting machines that do not provide a voter-verifiable audit trail should be halted, and existing
machines should be replaced or modified to produce ballots that can be checked independently by the voter before being
submitted, and cannot be altered after submission. These ballots would count as the actual votes, taking precedence over
any electronic counts.
Election integrity cannot be assured without openness and transparency. But an election without voter-verifiable ballots
cannot be open and transparent: The voter cannot know that the vote eventually reported is the same as the vote cast,
nor can candidates or others gain confidence in the accuracy of the election by observing the voting and vote counting
processes.
All computer systems are subject to subtle errors. Moreover, computer systems can be deliberately corrupted at any stage
of their design, manufacture, and use. The methods used to do this can be extremely difficult to foresee and detect.
Current standards and procedures for certifying electronic election equipment do not require unambiguously that
equipment provide a voter-verifiable audit trail. Without a voter-verifiable audit trail, it is not practical to provide reasonable assurance of the integrity of these
voting systems by any combination of design review, inspection, testing, logical analysis, or control of the system
development process. For example, a programmer working for the machine vendor could modify the machine software to mis-record a few votes
for party A as votes for party B, and this change could be triggered only during the actual election, not during
testing. Many computer scientists could list dozens of other plausible ways to compromise computerized voting machines.
Most importantly, there is no reliable way to detect errors in recording votes or deliberate election rigging with these
machines. Hence, the results of any election conducted using these machines are open to question.
Available alternatives to DRE machines
When a reasonably reliable, accurate, and secure voting technology is already in use, such as optical scan ballots,
acquisition of DRE machines would be a major step backwards. However, many areas urgently need to upgrade their
equipment before the 2004 elections. In these cases there are several acceptable options available now.
At this time, the only tried-and-true technology for providing a voter-verified audit trail is a paper ballot, where the
votes recorded can be easily read and checked by the voter. With appropriate election administration policies (for
example, ensuring the physical security of ballots), voters can be reasonably confident of the integrity of election
results. Two specific alternatives that are available now are:
- Precinct-based optical scan ballots. The CalTech/MIT Voting Technology Project found them to be the most accurate at
recording the voter's intent and not significantly more expensive per vote than touch-screen machines.
- Touch screen machines that print paper ballots. Such systems would have many of the advantages of DRE machines,
including potentially improved accessibility for voters with disabilities. There is at least one such machine that is
certified in several states, and we hope that all vendors of existing DRE machines could provide an option to add ballot
printers (DRE voting machines in Brazil have been retrofitted with ballot printers, for example). The paper ballots must
be submitted by the voters, to be available for counting or recounting and to avoid vote-selling. The votes on the paper
ballots must be regarded as the definitive legal votes, taking precedence over electronic records or counts.
Of course, use of appropriate equipment is not sufficient to guarantee election integrity. Elections must be
administered to minimize the possibility of error and fraud, and maximize the likelihood of detecting them if they
occur. In particular, even with an audit trail, audits must actually be conducted. If electronic counts are used from
machines that also print ballots, or if paper ballots are counted electronically, manual recounts must be conducted with enough frequency to make the detection of error or fraud likely.
Future Alternatives
There is certainly room for improvement in voting technology. Elections pose several unique technological challenges,
especially simultaneously achieving auditability while preserving ballot secrecy. Voting technology is an active
research area that has already produced several proposals that promise to be much better than any system currently in
use. For example, there are proposals that may be able to eliminate the possibility of "ballot box stuffing."
Unfortunately, if available funds are spent on fatally-flawed "high-tech" voting equipment, it will be a long time
before there is more funding to adopt truly superior voting technology.
Conclusion
The conduct of elections has been taken for granted for too long. Election reform is now receiving much-needed
attention, but we must guard against changes that inadvertently create even worse problems. Unauditable voting equipment
will erode confidence in our elections, causing further disillusionment of the voting public.
FOR THE LIST OF ENDORSEES OF THIS STATEMENT SEE…