Friday, February 18, 2011

Quick! What's the difference between a voting machine and an ATM?

There are many, of course, but the most fundamental difference is: anonymity.

Many people have said to me, "I don't have a problem with electronic voting. I live my life online, I do my banking on my computer, why shouldn't I vote electronically?"

It's a fair question. I also do my banking in cyberspace. But what if there was no way to reconstruct a record of your transactions and you had to blindly accept the bank's statement of your balance? That's essentially the case with electronic voting.

American democracy is -- wisely -- built on ballot secrecy, which helps to deter intimidation, coercion, and the buying or selling of votes that could quickly corrupt our form of governance. But it also means that the only person who knows whether a vote was counted correctly is the voter. And once the ballot is cast, there should be no way to reconnect that voter with that ballot. So what kind of safeguard can we build into the system to help ensure that the ballot is interpreted and counted as the voter intended to cast it?

Some of the world's top computer scientists and cybersecurity experts have put their heads together on this problem, and the answer they have arrived at may surprise you: hand-marked paper ballots are the most secure form of voting currently available. Why? Because they preserve the original record of the voter's intent, verified directly by the voter, so that if any questions later arise about the election results, the paper ballot can be re-examined and recounted to determine how voters really voted. No other type of whiz-bang high-tech solution can provide this level of certainty about the voter's intent.

Consider the Minnesota race for U.S. Senate in 2008. Minnesota votes statewide on paper ballots counted by optical scanners. Because voters do not always mark their ballots in a way that is easily interpreted by a scanner (or even by a human sometimes!), a very close race such as the one between Coleman and Franken often triggers a recount. Recounts can be messy and time-consuming, as this one was -- the victor was not sworn in until eight months after the election -- but if they are conducted honestly by rules clearly established in advance, they provide the fairest way to determine the outcome of a close election.

By contrast, electronic voting provides no such fail-safe. A hotly contested race for an open Congressional seat in Florida in 2006 is a perfect example. Nearly 18,000 ballots in Sarasota County (almost 15% of the ballots cast) registered no vote at all in that race. However, among voters in the other counties in that Congressional district -- all of whom voted on paper ballots -- as well as voters in Sarasota who voted on absentee or provisional paper ballots, the percentage of voters who skipped that race ranged from 2% to 5%. Democrat Christine Jennings was widely favored to win Sarasota County, the most strongly Democratic area of Congressional District 13, and an examination of the ballots that registered no vote in that race shows that most of them solidly backed Democratic candidates in other races on the ballot. Yet Republican candidate Vern Buchanan was declared the winner by 369 votes.

A subsequent investigation by computer scientists could not determine the cause of the missing votes. However, based on the political inclinations of the disenfranchised voters, it is very likely that the outcome would have been different if their votes had been recorded in that race. Florida has since abandoned its paperless voting equipment and moved to optically scanned paper ballots statewide in time for the 2008 elections.

Now about that ATM. How long would you continue doing business with a bank where sums of money this large -- 15% of your account balance -- could disappear without explanation or recourse? Is our democracy any less worthy of safeguarding?


  1. In October of 2006, Dr. Ed Felten of Princeton University demonstrated how something like what happened in Sarasota County, FL, could have been the result of malicious tampering. He used the exact same touchscreen machine that is used in Maryland's elections and, in less than one minute, inserted software that electronically changed votes on random ballots to achieve a pre-determined result. The rogue program waited until all ballots were cast to determine how many ballots needed to be changed and then erased itself and left no trace. He demonstrated this live at a hearing before a committee of the Maryland Senate.

    An excellent 10-minute video demonstration of the exploit, the full research paper and other information about Dr. Felten's research is here:

  2. One of the advantages of a voter-marked and -verified ballot could be that, if each ballot had a unique randomly generated serial number that only the voter retained a record of then, in the event that, during a recount, it was impossible to determine what the voter's intent was, the serial number could be posted online and the voter who had voted that ballot could come in establish that it was indeed his ballot, and tell the election judges what his intent was.


Please add your thoughts here