Where's the Paper Trail for Each Ballot Cast?
A Chance to Make Votes Count, Editorial, New York Times, Sept. 6, 2007
It's easier to "explain away" ballots lost on electronic voting machines than lost boxes of paper ballots. Just call it a "glitch" and then no one is responsible for it.
Electronic voting undermines democracy -- because the legitimacy of elections requires us to handle votes in a way that ordinary, non-technical citizens can observe, understand, and attest is proper and honest.
What's the problem with computers in elections? The blue display below is a teaching demonstration called the Fraudulent Voting Machine. Please use it to run some elections, and then read the explanation below it.
The demo starts by asking you to choose a "machine test" or "real election." Machine tests give accurate final tallies, but real elections might not! This is because, in a real election, one particular candidate is programmed to win.
Is it realistic to demonstrate a program that works two different ways? Yes! If you read the news you know that at least one major manufacturer of voting systems does something similar -- they use one program during tests, and a different program during real elections. And many manufacturers install "patches" -- which means different programming -- just before an election.
The demo runs an election with two candidates, John Doe and Mary Smith. In a "real election" if you enter any votes, Mary Smith will win. Fraud can look totally authentic -- to see for yourself, run a real election and enter more votes for John Doe, or give both candidates the same number of votes. After running your elections, read more below!
In a REAL ELECTION, if any votes are cast, Mary Smith WINS, and John Doe LOSES.
To see how computers can tamper with election results, select a REAL ELECTION. Then enter more votes for John Doe, or give both candidates the same number of votes. (To take this vote "test" click on www.wheresthepaper.org/
Explanation
If you ran a "real election" and gave more votes to John Doe, you saw the Fraudulent Voting Machine reverse the tallies (Mary Smith got the votes intended for John Doe, and vice versa). If you gave the same number of votes to both candidates, you saw that one vote was subtracted from John Doe and added to Mary Smith. However, an election director would be 100% within their rights to say that these elections were perfect and that they saw no errors. This is because, unless there is an audit, election personnel can check only one thing -- is the number of voters the same as the number of ballots?
The only reason YOU know the ballots and final tallies were wrong is that you saw ALL the votes being cast. In a real election, each voter has a secret ballot. There isn't any one person who can watch all the ballots being cast so, unless there is an audit, no one can know if the final tallies are right or wrong.
It doesn't matter if the problem was caused by an innocent mistake, malicious intent, an insider, or an outside hacker. Democracy was lost. The ballots were changed by the machine. The vote count was wrong. The wrong candidate won.
Voter-verified paper audit trails, and audits
Voting machines are in the news because the Help America Vote Act of 2002 (HAVA) offered billions of dollars to the states to replace old lever-type and punched-card voting equipment with new systems. Many states bought "Direct Recording Electronic" voting systems, called DREs. In the November, 2004, election, an estimated 25-30 percent of American voters cast their ballots on DREs.
DREs typically resemble PCs with touch-screen capability and a few buttons instead of a keyboard. Election officials say that voters "like" DREs, but as of September, 2004, 42% of voters said they didn't trust them. The reason? These systems conceal the recording and counting of votes -- and the history of elections shows that whenever these parts of the election process are concealed from public view, errors and fraud will occur.
In other fields, computer systems achieve accuracy (sometimes called "security") by being independently audited on a routine, continuous basis. "Auditing" is any procedure that enables you to prove that the results of normal operation are accurate, or to identify inaccuracies that need correction. Computer security requires more than "safety from hackers" because ordinary errors cause most of the problems. Independent audits are a universally-accepted standard practice in every field where people want accurate record-keeping. Every legitimate computer system in business, industry, and government is audited on a routine, continuous basis.
An independent audit of electronic voting systems would restore people's ability to observe the accuracy of two things -- how ballots were recorded, and how votes were counted. There would be two requirements.
First, the computerized voting system would have to print a "voter-verified paper ballot" (sometimes called a "voter-verified paper audit trail" or VVPAT) for each voter to verify before leaving the booth. This is a printout of the voter's ballot with his or her votes, and the voter checks it for accuracy. If it is correct, it goes into a locked ballot box. The law would have to recognize this voter-verified printout as the legal ballot.
When the voter verifies that his or her printout -- the permanent, unalterable paper ballot -- is correct, this restores public oversight of ballot recording. (The ballot is supposed to be recorded inside computer memory also, but anything in computer memory can be lost or changed. Computers used in elections have lost hundreds of ballots, and voters have actually seen their votes switched to other candidates on the computer screen many times.)
Second, after the election is over and the electronic voting system produces its final tallies, the Board of Elections must conduct a full count of all voter-verified paper ballots in full public view. This is the second half of restoring public oversight -- the audit that enables people to verify that the computer's vote tallies are correct because they are the same as tallies of the voter-verified paper ballots.
What if the audit shows a difference between computer and paper ballot tallies? Then a "reconciliation" must be done. That means an investigation to show why there are differences -- mistakes and/or fraud by humans and/or computers.
The comparison of computer and paper ballot tallies (and reconciliation if needed) must show that each computer was 100% accurate. This is because, as a Yale study recently showed, if the election was run with software that causes only a single vote per machine to be switched from one candidate to another, many election outcomes can be changed.
To summarize: voter-verified paper ballots alone cannot protect election integrity. These ballots are only a tool for conducting an audit. Unless a complete, independent audit is done (count of votes on the paper ballot printouts, and reconciliation of the computer and paper ballot tallies if needed), election results should be considered suspect due to secrecy of procedures. Unless the audit shows that the computer was 100% accurate, election results should be considered suspect due to inaccuracy.
This is simple and straight-forward. Every business conducts routine, continuous audits and reconciliations. What's the problem?
The problem is political
Even gas pumps print paper receipts! Yet, most DREs in use today cannot print a paper ballot while the voter is still in the voting booth to verify it. Our federal government has refused to require that computers used in elections be verifiable, in spite of years of warnings about the limitations of computers. Some state and local governments have required verifiability, but none have required routine verification.
Several vendors of DREs now offer systems that make voter-verifiable printouts, and time will tell whether these printouts are ever used to perform audits. Some vendors still say that their systems can make printouts after the election is over. At that time, their systems can print complete marked ballots that have been stored in the computer's memory, as well as a log report of the day's events (called an audit trail).
But something that's printed after the election is over can't provide proof of accuracy -- because the voter is no longer present to confirm that the printout of his or her ballot is correct. Unless voting system programmers are really incompetent, all end-of-day printouts will agree with the system's final vote tallies--whether those tallies are correct or wrong. (This is because all end-of-day printouts would be created from the same electronic data in the computer's memory. That data can be correct or wrong.)
Electronic voting systems that can't print a voter-verifiable paper ballot can't be audited -- and should not be used.
It is strange, but at this time, no Board of Elections or legislature intends to require that computers used in elections be used according to professional standards! No law requires that routine, independent audits of any computerized election be performed! Legislation that requires VVPAT requires only surprise random counts of the votes on VVPAT for a small percentage of voting precincts. That is not an audit. Ask yourself, would you be happy with a bank or brokerage company that audits 2 percent of its records? Why are our elections less important than our money? Why should Boards of Election be held to such a low standard? Would you trust a bank that never sent out statements, and advised you "The fact that our ATMs print receipts proves that we have everything under control and you can trust us, but you don't get to keep the receipt, and we will keep it for you, and you don't get to look at any of our records"?
In many states, full recounts are triggered only by a "close election." The concept of a "close election" is related to paper ballot or mechanical "lever" voting systems where fraud requires a lot of work by a large number of people in a large number of polling places or the central count location. With computerized fraud, one person can falsify the results of every machine in a matter of seconds and provide any margin of victory he or she wishes.
Courts have repeatedly looked at small errors in election tallies, such as a few hundred or thousand ballots lost or switched to the wrong candidate, and said that these irregularities don't make any difference because "the election outcome would not be changed" by those ballots. Yet the Yale study showed that if an election is run with software that switches only a single vote per machine from one candidate to another, many election outcomes can be changed without having a close election.
What is democracy? What is tyranny?
Abraham Lincoln said democracy is government of the people, by the people, for the people.
History teaches us that whoever conducts an election and counts the votes can also control the outcome. Avoiding fraud requires an openly-observed process. If all parties participate and observe, we have the greatest possibility that our election outcomes will express the will of the people.
Our November election is suspect precisely because 25-30 percent of the voters used unverifiable electronic systems, and because many states and counties prevented citizens from observing the counting of ballots, handling of tally sheets, etc. Every American is being forced to "trust" that unobserved and invisible procedures -- electronic and otherwise -- were accurate.
Widespread charges of fraud are still circulating on the internet. Are the charges "bogus?" Are the people behind these charges "conspiracy theorists?"
In fact such suspicions are reasonable, given the intentional use of unverifiable computerized election systems -- even after the problems with such systems were publicized. The suspicions are realistic, given the widespread secrecy surrounding election operations in many counties and states. Secrecy suggests that something is being hidden. In many counties, tally sheets were not required to be posted in the precinct at the close of voting, ballots and precinct tally sheets were not guarded under multipartisan observation after the close of the election day, and counties have refused to comply with FOIL requests in an open and forthcoming manner.
When institutions hide what they do, indeed often fraud, stealing, etc. is taking place. Public servants should not only be honest, they must avoid the appearance of dishonesty. This idea is not new.
There is no evidence to support or refute charges of fraud, or resolve current suspicions about the November election. This weakens our democracy, and undermines the legitimacy of the election and the government. A democratic government has only as much legitimacy as the open observation and verifiability of its elections.
Elections are not a court of law where a defendant is innocent until proven guilty. Elections deal with a broader issue, the legitimacy and credibility of representative democratic government. Secrecy in the procedures of elections, especially vote counting, is a constant when a system of tyranny poses as democracy by holding sham elections.
Election directors and Secretaries of State have responded to warnings about unverifiable computerized voting by saying "I will comply with legal requirements." This reduces a democracy argument (democracy requires observation and verification of elections) to a legal argument (the law doesn't require observation and verification).
William Penn, founder of Pennsylvania, said (in 1682) that if the people are good, the government will be good. If the people are bad, no form of government will save them from their own evil. He meant that if those in power make laws that are just (tend toward equal opportunity, equal protection, and due process; allow observation and participation in governmental procedures and decisions), the people will thrive. If those in power make laws that are unjust, they can use the same governmental structures and rituals, such as elections, to support tyranny.
Josef Stalin: "It's not who votes that counts, it's who counts the votes!"
Anastasio Samoza: "You won the vote, but I won the count."
Boss Tweed: "As long as I count the votes, what are you going to do about it?"
Conclusions
1. We don't need computerized voting! Supporters of computerized voting claim that voters with disabilities or non-English languages need computerized voting. This is false. Certified computerized ballot-marking machines with assistive attachments can enable voters with disabilities or non-English languages to mark and verify paper ballots. All ballots, including absentee and provisional ballots, can be the same, thus simplifying the counting procedures. Counting can be done by hand or optical scanners. (When votes are counted by optical scanners, a manual audit must be done to confirm accuracy -- optical scanners are computers too, and are subject to error and fraud that can be detected only by hand-counts.) (info about voters with disabilities, chart of accessible and verifiable voting technology from VerifiedVoting.org).
2. If we are forced to use computers to record and count our votes, these computers should give us at least the same level of security (verified accuracy) and reliable ease-of-use that we get from computerized cash registers in our local supermarket. This means that Boards of Elections must perform the appropriate audits before multipartisan observers. Also, it means that if the computers fail, voters and pollworkers should not be blamed. In the professional world, computer systems to be used by nontechnical people are designed to prevent and handle all problems that could occur. We now have years of experience with the failures of computerized voting systems, and these failures should not continue to be excused as "glitches." Instead, Board of Elections must be held responsible for conducting elections with equipment that is unreliable and unsuitable. If an election worker "lost" hundreds of ballots, they would be held responsible. If an Election Director persists in using computer equipment that does the same thing, the Election Director should be held responsible.
3. Computer accuracy is not "free" -- it is achieved by continuous audits, reconciliations, and correction of errors. If this work is not done, the computer's results should be assumed to be inaccurate. Computers only give us speed of processing, audits give us accuracy.
4. It is simpler, more accurate, and less costly to conduct an election using hand-marked, hand-counted paper ballots than to use a computer system and then have to audit the computer. Everyone understands the use of paper, but only a few people understand the use of computers and how to audit them.
5. Democracy is not "free" and no one will serve it to us on a silver platter. There is no "right" to election integrity, it is a result of citizen participation. If we are serious about our democracy, we must do much more than simply vote. We must participate in running and observing our own elections by working at the polls, and also observe every aspect of the preparation and conduct of our elections.
6. The technology we use for voting should not arouse the massive outcry, controversy, and lack of voter confidence that unverifiable electronic voting systems have generated. To ensure confidence in our elections we should not use unverifiable computers. Instead, simple paper ballots should be used.
Avoid Computers in Elections - Better ways to vote
Let's get rid of computers in elections. They prevent people from observing procedures and verifying outcomes. Boards of Election do not have the resources and expertise to manage them securely.
We don't need computers to run elections, we need people -- not just to vote, but to do the work and observe -- everything from registering voters and to the final certification of winners.
Paper Ballots. Studies show that elections conducted with hand-marked hand-counted paper ballots are the most accurate. National and provincial elections in Canada use hand-marked, hand-counted paper ballots, and Canadians expect (and get) precise counts of voters, votes, and ballots with no discrepancies.
Optical Scanners. If Americans find hand-counting too difficult or burdensome, optical scanners can be used (along with proper manual recounts to detect errors in the optical scanner programming). Optical scanners in the polling place ("precinct-count optical scanners") can check paper ballots for correct marking. If a ballot is marked correctly, the optical scanner can count the votes and then drop the ballot into a sealed ballot box.
Proper security at the end of the election day means that a tally sheet printout from the optical scanner must be signed by the poll workers and posted publicly. Also each poll worker and observer must receive a duplicate signed printout. For each optical scanner, all ballots and another signed tally sheet printout must be stored together in a sealed bag so that recounts can be done scanner by scanner. The sealed bag of ballots and other records must be observed (guarded) at all times until the election is certified. The contents of each bag should not be mixed with the contents of any other bag.
Accessibility. Federal law now requires one accessible device per polling place so that voters with disabilities can enjoy a private and independent voting experience. An accessible computerized ballot-marking machine (the Automark) can enable such voters to mark their paper ballots. Accessible computerized ballot-printing machines are also available (Populex).
Mechanical Lever Machines are old and many have not been maintained well. If they are repaired, they can continue to serve most voters. Voters with disabilities who cannot use the lever machines would have to use an accessible ballot-marking or ballot-printing device, such as the Automark or Populex.
Punch Card Ballots have been discredited in the media, but when the ballot is designed clearly (as it should be) and when the mechanisms for holding and punching the card are working properly (as they should be), punch cards have one big advantage over computerized voting -- a human being can examine the punch card and determine the intent of the voter.
Computerized voting systems require more complicated procedures to ensure integrity. To restore public oversight of the election, and protect election integrity, we must require computerized voting machines to print voter-verified paper ballots, AND end-of-day tally sheet printouts must be posted publicly and provided to election observers (the same as with optical scanners), AND the voter-verified paper ballots must be guarded and observed at all times once cast, and stored in a separate sealed bag for each computer (the same as with optical scanners), AND the Board of Elections must conduct a full recount of all ballots in full public view, AND the recount must show that each computer was 100% accurate.
Elections using computerized voting machines must be 100% accurate because if the master copy of the original software causes only a single vote per machine to be changed, many election outcomes can be changed.
If the recount of voter-verified paper ballots differs from the computer tally, a "reconciliation" must be done (an investigation to show why there are differences -- mistakes and/or fraud by humans and/or computers, followed by correction of all errors).
Take action now!
1. Several web sites have lists of what to do.
2. Deliver the report "Myth Breakers: Facts about Electronic Elections" to your local election officials and legislators.
3. Join your local political club or good government organization. As a member, inform them about this issue and the need for action. Important documents are available, as well as a summary of the problems with evoting.
4. New Yorkers, please go to our New York page and take action.