Prodded by the federal legislation enacted to prevent the 2000 presidential election debacle from happening again, jurisdictions across the country have been moving away from paper-based and mechanical methods of voting towards the use of so-called direct recording electronic (DRE) devices, computerized voting machines that work much like bank automated teller machines. But in the process of trying to solve problems associated with the old systems hanging chads and the like a whole new set of concerns have arisen. What began as a campaign a couple of years ago by a small group of computer scientists who believe that DRE systems are vulnerable to hacking and malfunction has become a national controversy.

On DREs, voters make their choices either by touching the screen or by pushing a button. Usually there is only one candidate selection to make per page, and if a voter does not vote in a particular race, the computer asks the voter to confirm that he or she meant not to vote. The last screen usually shows the voters choices and asks if this is indeed how the voter wishes to cast his or her ballot. It also offers the opportunity to go back and change a vote in any give race. Finally, the voter presses the screen or button to cast the ballot.

According to Election Data Services,1 the portion of U.S. voters using electronic equipment is estimated to rise from 13 percent to 29 percent. More than 50 million voters are in jurisdictions that will be using electronic voting equipment this fall.

Other voting systems that still will be used in the upcoming election include:

• Optical scan machines: These require voters to indicate their choice by filling in a circle or completing an arrow that points to the candidate. Optical scanners then read the ballot and record the votes depending on the marks made. About 55 million voters (32 percent of all voters) reside in places that will use optical scan machines in 2004.
  


• Punch card machines: These infamous voting systems that were used in much of Florida in 2000 require the voter to indicate their choice by making holes in a card. A machine then reads the card and records the vote according to where the holes have been punched. Approximately 32 million voters (19 percent) still will be using punch card machines this year.
  


• Mechanical lever machines: These turn-of-the-century systems require votes to flip levers next to names and ballot questions. The machine internally records the vote. About 22 million voters (13 percent) live in jurisdictions that will use these machines in the upcoming presidential election.

About 1 million voters, mostly in rural areas, will be using old-fashioned paper ballots.

The Help America Vote Act (HAVA), enacted in 2002, imposed several requirements on states with respect to voting machines, while providing federal funding for replacement of older technologies. This has helped to accelerate the pace at which jurisdictions around the country have moved toward direct recording electronic machines.

The law requires that, beginning January 1, 2006, all voting systems used in federal elections must:

• Permit voters to verify their selections on the ballot, notify them of overvotes (votes for more than one choice in a single race), and permit them to change their votes and correct any errors before casting the ballot. This requirement does not mean that electronic systems are mandatory jurisdictions using paper ballots, punchcards, or central-count voting systems instead may conduct voter education on how voters can prevent overvoting.



• Produce a permanent paper record for the voting system that can be audited manually and is available as an official record for recounts. This is distinct from a voter paper audit trail. HAVA does not require that the voter see a paper copy of his or her vote).



• Provide to individuals with disabilities, including the blind and visually impaired, the same accessibility to voting as other voters. That can be accomplished either through use of at least one DRE or other accessible voting system at each polling place;



• Provide alternative language accessibility as required by law.



• Comply with the error rate standards (the percentage of votes lost by the voting system) that are to be established by the Election Assistance Commission, the new federal agency set up to oversee implementation of HAVA.

The act provided that up to $325 million be available to states that want to replace their punch card or lever machines.

DREs offer several important advantages over other voting systems. Perhaps most important is that, unlike other machines, they can be made fully accessible to the disabled, including the visually impaired. In the next election, many disabled voters will, for the first time ever, be able to cast private, secret ballots at their polling sites. DREs have the capacity for features such as audio voting for the visually impaired and hand-held voting devices for voters with limited physical dexterity.

In addition, as voters become more familiar with DRE machines, there will be a lower rate of "spoiled ballots," ballots that are not counted because there is some kind of error made on them. In part this is because, unlike with punch card and optical scan machines, DREs make it impossible to overvote inadvertently make more than one choice in a race. Voters report in survey after survey that they find using DREs easy.

Computerized voting machines also have the capacity to provide ballots in an unlimited number of languages, making them the most accessible to language minorities among any of the machines.

Finally, a number of studies have shown that the votes of minorities are less likely to be counted when paper-based systems are used, and that these disparities are greatly reduced when electronic forms of voting are employed.2

Computer scientists have pointed to several flaws in the computerized voting systems currently available that make them vulnerable to manipulation and/or malfunction. The main concerns revolve around (1) vulnerabilities in the source code, the language of the software; (2) potential problems with the transmission of vote counts; and (3) the inability of voters and vote counters to verify independently that the computer has recorded and reported the votes as the voters intended

Computer scientists describe the problems in the way source code is written as the biggest threat to voting security and accuracy. It is possible that whoever programs the software, or who gains access to the software through hacking, could tamper with it to alter the results. For example, the software could be made to drop or change votes, or change total vote counts, depending on the direction in which the tally is going.3

Researchers at Johns Hopkins University examined software used by one of the biggest voting machine manufacturers, Diebold, and inadvertently made available on the Internet, and found many security flaws that left the systems vulnerable to vote tampering opportunities.4 Among the flaws they found out that since the voting system relies on a smart-card chip to ensure that each person casts only one ballot, someone could create a specially programmed smart card and use it in the voting booth to cast multiple ballots.5

Computer experts claim that such tampering with source code might never be detected. Worries about manipulation were heightened when it was reported that the Diebold chairman wrote in a fundraising letter last year that he was committed to helping Ohio deliver its electoral votes to the President next year."6

Computer scientists also believe that DREs are vulnerable to interference during transmission of results. Although election results usually are not transmitted from precincts via the Internet, they may be transmitted via a direct modem connection. Since telephone transmission systems themselves increasingly are connected to the Internet, computers may be connected to the receiving server through an Internet connection.7 Some say that a hacker could intercept an encrypted call from a precinct to the receiving server and the call in fraudulent results.8

Most DRE machines do not provide an independent record of each individual ballot that can be used in a recount to check the machine for error or tampering. It is impossible to check if the voting machine records a vote in its memory different than the one the voter cast.9 When someone votes using a punch card ballot or an optical scan machine, those ballots are saved and can be counted if an election is called into question. The paper ballots can be compared to the machine vote. DRE machines do not provide that capability.

There is no hard evidence to show that any computer voting machine has in fact been tampered with, and they have been used in this country for many years. However, there have been many incidents in which there have been malfunctions. All voting systems break down it is unclear whether DREs break down at a greater or less rate.

However, because of the increased scrutiny of voting machines, the instances of malfunctions of DRE machines have been highly publicized. This has heightened the sense of alarm about using the machines in November.

Among the incidents reported on are the following:

• In the March California primary, a machine part failed causing 1,038 polling places in San Diego County to open late; counting software in San Diego gave several thousand of John Kerry's votes to Dick Gephardt, who already had dropped out of the Democratic presidential contest. In Orange County, poll workers gave thousands of voters the wrong electronic ballots, allowing them to vote where they did not live.10 In Alameda County, 186 of the 763 encoders used to program the "smart cards" failed.11 As a result of problems such as these, many Californians called for a ban on electronic voting in the November election.



• In a special election in Florida, 134 people who used the touch-screen system did not have a vote recorded in an election that was decided by twelve votes12



• There were numerous problems in a November 2003 election in Virginia. According to PC World magazine, "When polls closed at 7 P.M., many of the county's 223 precincts tried to transmit their results to the election center at once, tying up the line for hours. Many precinct judges gave up and drove their tallies to headquarters. A software problem delayed some results for 21 hours. Voters claimed that some of the booth machines crashed and had deleted some votes before their eyes. Election officials repaired ten broken machines off-site, with vote data inside, then returned them to service a violation of state law."13



• In Muscogee County, Georgia, in 2003, touch-screen machines registered "yes" when voters voted no. When notified of the irregularity, polling workers advised voters to cast the opposite of their intended vote, the NAACP reported. 14



• In Montgomery County, Maryland, during the 2004 primary, an unknown number of votes were cast on touch-screen machines manufactured by Diebold Inc. that presented the wrong candidate when the font was magnified.15

Those who have led the campaign to alert people to what they say are the dangers of electronic voting have offered proposals for preventing anything untoward happening as a result of their use. Most of these suggestions come from computer scientists, but have been picked up by many advocates, elected officials and the press.

The idea for fixing the problems associated with DREs that has gained the most attention is to require a "voter verified paper trail" (VVPT). When advocates refer to VVPT, they mean that computerized voting systems would produce a paper copy of the voter's choices that would appear under a glass screen to be verified and then deposited in an internal box. Proponents argue that by having a contemporaneous, independently cast, physical paper ballot, a manual recount is possible if the election is challenged. In addition, voters can be sure that the vote they cast on the machine is the vote that is actually being recorded and tabulated.

Bills have been introduced in Congress and in sixteen state legislatures across the country. Nevada has banned the use of machines without VVPT for the 2004 election, and California will require that all DRE machines have a paper trail by 2006. At the same time, a number of groups are strongly opposed to VVPT.

The competing views:

Computer scientists have led the effort to promote VVPT, with some civic organizations, such as Common Cause, joining them. Representative Rush Holt (D-NJ) has introduced legislation in the House of Representatives, and has spoken widely on the topic. Senators Hillary Clinton (D-NY) and Bob Graham (D-FL) also have introduced proposals that include a VVPT requirement.

Proponents argue that the only way to ensure the sanctity of the vote is to have a paper audit trail. As explained by www.verifiedvoting.org,

These [DRE] machines are dangerous for democracy. With the computer technology they are using, there is always a risk that a program flaw or, worse, tampering with the software could change votes and even change the outcome of elections. And these changes might not be detected! Since ballots are secret, once the voter leaves the booth there is no one who can detect or correct any errors that the machine made in recording the votes. If the election results are obviously absurd, as happens occasionally with other kinds of vote-counting equipment, the only options will be to accept an obviously wrong election result or hold a new election.

The solution is simple: require there to be a voter verifiable audit trail with all voting equipment. A voter verifiable audit trail is a permanent record of each vote that the voter can check to ensure that it represents their intent. These votes are deposited in a secure ballot box. If there is a manual recount, we can be sure that the votes being counted are what the voters wanted to cast.

Advocates say that while there may be new ways to have independent verification of the vote without using paper in the future, for now VVPT is the best mechanism available. As Common Cause states,

We do not believe that current touch screen technology allows the voter to verify his or her vote in a meaningful manner. The voter must have faith that the internal software is correctly tallying the vote and there is currently no way to verify the vote independent of that software. We believe it is critical at this point to provide a voter-verifiable paper audit trail as one of the essential requirements of voting systems. While we recognize the demonstrable problems with paper-based voting systems and support efforts to develop new technology for future voting systems, including all-electronic verification systems, we remain convinced that, for now, a paper-based verification system is the best alternative.16

Some civil rights organizations, such as the Leadership Conference for Civil Rights, advocates for the disabled, election administrators, and some civic organizations, such as the League of Women Voters and the original authors of the Help America Vote Act, are opposed to the immediate implementation of a VVPT requirement.

These groups offer several arguments against VVPT. They include the following:

• VVPT is unnecessary. Most elections using electronic voting have gone smoothly, and there never has been any evidence of vote manipulation. The League of Women Voters says,

  It has been suggested that DRE machines are inherently subject to fraud unless there is an individual paper record of each vote. This seems extreme. DREs are extremely sophisticated machines and most DREs store information in multiple formats and in multiple places within its program. To tamper with a DRE someone would need to know each and every format and storage capacity and be able to manipulate it undetected. Additionally, it must be remembered that DREs are not an election system unto themselves; they are simply an instrument within a complex election system. The key is to design an overall system that builds in multiple checks making it improbable that the system will be tampered with.

• VVPT is not really a check against fraud. According to researchers at the Caltech/MIT Voting Technology Project, the paper receipts produced by VVPT can be systematically and undetectably misprinted in short, the VVPT itself is susceptible to fraud.17 In a statement, the League of Women Voters similarly argues,

  Simply because a voter verifies their vote on a piece of paper does not guarantee the same results have been be recorded within the machine and vice versa. And why would we assume that, if the total from a paper count and the total from a machine count are different, the paper count is accurate? Is it not just as easy to tamper with an election by losing a couple of paper ballots or miscounting them during a recount?18

A better check against fraud would be random audits of the machines and independent testing before the election. Paper ballots are actually much easier to tamper with than electronic ones, opponents of VVPT say.

• VVPT causes administrative problems because printing the ballots causes printer jams and other problems that can delay and confuse the voting process. It also makes each machine more expensive.



• Advocates for the disabled argue that a paper trail cannot be made accessible to the disabled and therefore takes them a step backward from where HAVA promised to take them. In particular, by requiring verification of a paper ballot before casting a ballot, blind voters are denied access to a secret and independent verification of their ballot."19



• There are better options. For example, Ted Selker from MIT suggests an electronic voice that reads voters' choices back to them over a headset for verification. That audio track could be recorded, providing an independent record of the vote. He also has developed what he says is a secure voting system that uses multiple redundant software components.20 Finally, some computer scientists favor an independent confirmation of the vote as with a paper receipt that is done electronically. Through this system, the voter is given what is called a "frog" (a name created by computer scientists). The voter places his or her frog in the appropriate "vote-capture" equipment and makes his or her choices, which are recorded on the frog. Then, the voter then takes his or her frog from the vote-capture equipment to the "vote-casting" equipment, and casts his or her vote. His or her frog is secured and retained as part of the audit trail.21
  

Another alternative or additional proposal to remedy the perceived problems is to require the manufacturers to allow their source code to be inspected by outsiders. Advocates of open source code say that independent review of it would be more thorough and thus make the system more secure. Opening review of the source code would help reassure voters that their votes were not going to be manipulated and give transparency to the voting and vote counting process.

Voting machine manufacturers oppose open source code because they consider it to be proprietary information.

Much of this controversy could have been avoided if the Election Assistance Commission (EAC), the new federal agency established by the Help America Vote Act to provide guidance on such issues, had been created in the time frame the law envisioned. Unfortunately, foot-dragging on the part of the White House and Congress delayed the formation of the organization by ten months, and it is only now up and running.

The EAC finally held a hearing on the issue of DREs on May 5, receiving testimony from experts and advocates on all sides. The agency is expected to issue some sort of recommendations on the topic, but nothing it says or does will be timely enough to be implemented by this November's elections. Moreover, the EAC continues to labor under great shortages in staff and funding. The lack of funding has affected the agency's ability to undertake many of the tasks the authors of the Help America Vote Act had hoped it would. For example, it will not be able to develop a national system for testing voting machines.22

That brings the issue squarely back to the White House and the Congress. Up to now, federal legislation requires states and localities to make major overhauls in the system by which their citizens vote, yet the federal government has failed to provide the money, assistance, or expert guidance it promised in the bargain. That has proven to be a recipe for controversy. Until it is resolved, we can expect the election system its sanctity, legitimacy, and efficiency to be under a cloud of mistrust and suspicion with the American public.

Written by Tova Andrea Wang, Senior Program Officer and Democracy Fellow

1 All projections of machine use in 2004 can be found in "New Study Shows 50 Million Voters Will Use Electronic Voting Systems, 32 Million Still with Punch Cards in 2004," Election Data Services, Washington, D.C., February 12, 2004.

2 See Charles S. Bullock, III and M.V Hood, III, "One Person, No Vote; One Vote; Two Votes: Voting Methods, Ballot Types, and Under-vote Frequency in the 2000 Presidential Election,"Social Science Quarterly 83, no. 4 (2002): 981.93; Michael Tomz and Robert P. Van Houweling, "How Does Voting Equipment Affect the Racial Gap in Voided Ballots," American Journal of Political Science, June 12, 2002.

3 Eric A. Fischer, "Election Reform and Electronic Voting Systems (DREs): Analysis of Security Issues," Congressional Research Service, Washington, D.C., November 4, 2003, p. 14.

4 See Johns Hopkins University Information Security Institute, Technical Report TR-2003-19, July 23, 2003, available at
http://avirubin.com/vote.pdf.

5 Alan Boyle, .E-voting Flaws Risk Ballot Fraud,. MSNBC, July 24, 2003, available at
http://msnbc.msn.com/id/3077251/.

6 Viveca Novak, "The Vexations of Voting Machines," Time, April 26, 2004, p. 42.

7 Eric A. Fischer, "Election Reform and Electronic Voting Systems (DREs)," p. 14.

8 Paul Boutin, Is E-Voting Safe? PC World, April 28, 2004.

9 Eric A. Fischer, "Election Reform and Electronic Voting Systems (DREs)," p. 15.

10 John Wildermuth, "Touch Voting a Worry," San Francisco Chronicle, April 26, 2004, p. A1.

11 Viveca Novak, "The Vexations of Voting Machines," p. 42.

12 John Wildermuth, "Touch Voting a Worry," p. A1.

13 Paul Boutin, "Is E-Voting Safe?"

14 Kavan Peterson, "Integrity of Electronic Voting Questioned," Stateline.org, May 3, 2004, available at
http://www.stateline.org/stateline/?pa=story&sa=showStoryInfo&id=368968.

15 Ibid.

16 "Statement on Voting Machines," Common Cause, Washington, D.C., March 2, 2004.

17 Ted Selker, John Goler, "Security Vulnerabilities and Problems with VVPT," Caltech/MIT Voting Technology Project, April 2004, p. 5.

18 "Direct Recording Electronic (DRE) Voting Machines and HAVA Implementation," League of Women Voters, Washington, D.C., June 12, 2003.

19 "Policy Statement on Voter Verified Paper Ballots," American Association of People with Disabilities, Washington, D.C., available at
http://www.aapd.com/dvpmain/elreform/aapdballots.html.

20 Elizabeth Heichler, "E-Voting Critics Get Louder," PC World, December 15, 2003

21 Sara Robinson, "Did Your Vote Count? New Coded Ballots May Prove It Did," New York Times, March 2, 2004, p. F2.

22 "E -Voting Oversight Overwhelms U.S. Agency," Associated Press, May 4, 2004.