Senate Rules Committee Testimony of David Dill
June 21st, 2005
Testimony David L. Dill, Professor of Computer Science, Stanford University and Founder of the Verified Voting
Foundation and VerifiedVoting.org
Before the Senate Committee on Rules and Administration, June 21, 2005
Hearing on Voter Verification in the Federal Election Process
Chairman Lott, Ranking Member Dodd, Members of the Committee:
I am grateful for this opportunity to address the crucial issue of electronic voting in American elections. The debate
about electronic voting should not be about whether election fraud has occurred, is occurring, or even will occur; it
should be about the transparency of our elections. By “transparency,” I mean the ability to do independent checks on the
conduct and results of the election. Ultimately, this debate is about public confidence in our democratic system.
The real purpose of an election is not to convince the winners that they won, but to convince the losers that they lost.
So, it is not sufficient that election results be accurate; the public must know that the results are accurate. That can
only be achieved by making election processes as transparent as possible.
Unfortunately, paperless e-voting technology is almost totally opaque. No one can scrutinize critical processes of the
election, such as the collection of ballots and counting of votes, because those processes occur invisibly in electronic
circuits. Voters have no means to confirm that the machines have recorded their votes correctly, nor do they have any
assurance that their votes won't be changed later. Paperless e-voting, in its current form, is a threat to democracy.
The basic problem of e-voting can be understood without an in-depth knowledge of computer technology. Here is a helpful
analogy: Suppose voters dictated their votes, privately and anonymously, to human scribes, and that the voters were
prevented from inspecting the work of the scribes. Few would accept such a system, on simple common-sense grounds.
Obviously, the scribes could accidentally or intentionally mis-record the votes with no consequences. Without
accountability, a system is simply not trustworthy, whether or not computers are involved.
You don't need a Ph.D. in computer science to understand the basic problem with computerized voting. Computer systems
are so complex that no one really knows what goes on inside them. We don't know how to find all the errors in a computer
system; we don't know how to make sure that a system is secure or that it hasn't been corrupted (possibly even by its
designers); and we don't know how to ensure that the systems in use are running the software they are supposed to be
running. Technologists have not been able to solve these problems even with measures that are far more sophisticated
(and costly) than those used in the design and certification of voting equipment.
There is strong agreement among computer technologists that what I just said is true. For example, the Association for
Computing Machinery, the largest professional organization of computer technologists, adopted a position against
paperless electronic voting after an internal poll showed that 95 percent of their membership agreed with the position.
What can we do about this problem? Returning to the analogy with the scribe, that system can be made trustworthy by
having the voter fill out his own ballot or by allowing each voter to check the ballot filled out by the scribe. We can
have a trustworthy voting system if, instead of a futile effort to ensure that the voting equipment is error-free by
design, we empower each voter to verify that his vote has been accurately recorded. In other words, we need
voter-verified paper ballots.
The call for paper ballots is not based on nostalgia. Paper has specific properties, as a technology, that we don’t know
how to replicate in electronic media. For example, most voters can verify the contents of a paper ballot without
computer mediation; paper can be written indelibly; and the procedures for handling critical paper documents are easily
understood by ordinary poll workers and voters. In addition, electronic ballot marking devices now exist to enable
voters with disabilities to mark and verify optical scan ballots.
Paper is not a magical solution to our election problems, but, at least, understandable procedures exist for ensuring
the accuracy of an election conducted with paper ballots. In particular, the ballots must be protected, and the
processes for storing, transporting, handling, and counting them must transparent. Ideally, members of the public and
non-governmental organizations as well as political party representatives should be able to observe all of the steps of
an election, including machine testing, polling place operations, counting of votes, auditing and recounting.
One of the most important practices that could be adopted is the routine auditing of elections by choosing a small
random sample of the ballots and manually counting them. This practice would make a valuable distinction between
“audits,” which are routine checks on the quality of elections, and “recounts,” which have become increasingly
politicized. Routine random audits would often catch procedural, equipment, and personnel problems in uncontroversial
elections, so that those problems can be fixed before they potentially affect an election outcome.
Many jurisdictions need to upgrade their outmoded voting systems, including the notorious punch-card systems that are
still used in many. These jurisdictions do not need to buy paperless e-voting machines. By upgrading to precinct-count
optical scan systems, they can have the most accurate available voting systems at a small fraction of the cost. Indeed,
Miami-Dade County is seriously considering scrapping the touch-screen voting system they acquired only three years ago
for $24.5 million dollars, for a precinct-count optical scan system, because of the unexpectedly high operational and
maintenance costs of the touch-screen system.
Objections have often been raised to paper ballots by advocates for voters with disabilities. On the one hand, these
arguments ignore the fact that there is now equipment for making optical scan ballots accessible to voters with
disabilities and non-speakers of English, and that touch-screen machines with voter-verified paper audit trails are
every bit as accessible as the same machines without the audit trails. On the other hand, these arguments idealize the
accessibility of existing touch-screen machines, which fail to accommodate some kinds of disabilities, and often
disappoint even those voters with the specific disabilities for which they were designed.
In the future, I hope that better voting technology will exist, perhaps even a trustworthy paperless technology. Maybe,
someday, we’ll be happily using cryptographic ballots or audio audit trails. However, at this time, there is no such
technology that is ready for use in our polling places. The theoretical possibility of a trustworthy paperless voting
technology in the future should not distract us from dealing with the problem that thoroughly untrustworthy paperless
machines are now being sold.
In summary, paperless electronic voting is a technology that is fundamentally hostile to election transparency. No one
can tell what is going on inside the machines, and there are no procedural changes that can remedy that flaw. Instead of
seeking a technological quick fix to our election problems, we should return to paper ballot systems, and focus our
energy on making our elections more trustworthy by improving election practices. This can be done without reducing
accessibility to voters with disabilities. Furthermore, it is the fiscally responsible choice.
There is considerable public awareness of this issue, as is witnessed by activity at the state level. At last count, 22
states have requirements in place for voter-verified paper ballots. In many of these states, bills passed with unanimous
approval due to powerful constituent support. Another sixteen states are considering the issue; and only twelve have yet
to introduce legislation. There is, however, a need for Federal action to protect the rights of voters in those states
that have not passed such rules. The November 2004 election went more smoothly than the 2000 election only because the
margin of victory was greater than the “margin of litigation.” Electronic voting could have been at the core of a
dispute. In addition to local disasters because of flaky electronic voting machines, the Election Incident Reporting
System (developed by the Verified Voting Foundation) collected hundreds of reports from all over the country of odd
voting machine behavior, including machines that selected the wrong candidate and machines that sporadically left
candidates off of the ballots. The vast majority of these problems have been left uninvestigated and unresolved.
Our democracy is too precious to entrust to an ill-conceived and flawed technology. I would urge you to take up
legislation in this session to ensure that our election systems allow each voter to verify that his or her vote is
properly recorded. Several bills requiring voter-verified audit trails on all election equipment by the 2006 election
have been introduced already. If you act promptly, it is possible that every voter could use such a system in the next
major election. Thank you.