EPIC - Spotlight on Surveillance

Source: Diebold Election Systems

With a direct recording electronic (DRE) system, which has also been called "touch screen voting," a voter makes her choices by pressing buttons on or near the screen. Digital images of ballot selections are saved onto memory drives in the machine, but a voter-verified paper record is not created, unless the DRE is attached to a printer.

In the 2000 presidential election, there were questions about which candidate, Al Gore or George W. Bush, garnered the most votes in Florida. The resulting confusion concerning “hanging chads” (some punchcard ballots were not completely punched through, leaving part of the paper still attached to the ballot) and other ballot problems led Congress to pass the Help America Vote Act of 2002 (HAVA).³ The Act established a process to create voluntary standards for voting and voter-registration systems. HAVA established the Election Assistance Commission to oversee the process, and the National Institute of Standards and Technology assists in developing technical guidelines and standards.⁴ HAVA also sought to provide accessible and independent voting for people with disabilities, and requires each polling location to have one accessible machine.⁵

HAVA provided about $3.8 billion in federal funding to update or replace old voting systems, improve poll worker training, and voter education. Many local election jurisdictions have used the funds to buy either optical scan or direct recording electronic (DRE) systems to replace paper ballot, punchcard and lever systems. About 87% of voters will use either optical scan or DRE systems in November 2006, according to a study by Election Data Services, a consulting firm that tracks election information.⁶ With an optical scan system, a voter fills in the oval or connects an arrow next to the name of the candidate on the ballot, then the voter feeds the ballot into the ballot box, which records the vote.⁷ The paper copy of the ballot can be kept to ensure the accuracy of the vote. With a DRE system, which has also been called “touch screen voting,” a voter makes her choices by pressing buttons on or near the screen.⁸ The system “creates digital records of voter ballot selections and saves them on memory drive(s) stored within the voting system. No permanent record is produced at the time a voter casts a ballot.”⁹

There are three major companies that produce electronic voting machines: Diebold Election Systems, based in Ohio; Election Systems & Software, based in Nebraska; and Sequoia Voting Systems, based in California. Problems have been reported with machines from all three manufacturers during previous elections, including recent primaries. Chicago is withholding $26 million in payments to Sequoia, because equipment problems created significant delays in voting in the March primary.¹⁰ The state of Indiana filed a civil complaint against Election Systems & Software, accusing the company of “providing defective equipment and services.”¹¹ The case was recently settled, with the state receiving $750,000.¹² Recent reports have revealed that, in 2005, Diebold quietly replaced malfunctioning components in 4,700 machines sent to Maryland in 2002, without disclosing the replacements to the State Board of Elections.¹³ The company replaced the malfunctioning circuit boards in order to fix a glitch that could cause the machines to freeze, and some of these machines failed during both the 2002 and 2004 elections.¹⁴ Diebold’s contracts with Maryland are worth more than $100 million.¹⁵

Source: Election Data Services

Almost 90% of registered voters will be using electronic voting systems such as optical scan or direct recording electronic equipment. About 32% of registered voters in the country will be using new voting equipment.

In Maryland, many errors during the September primary, made both by machine malfunctions and poll worker confusion, led to long lines for voters, and in some cases, caused citizens to leave without casting a ballot.¹⁶ These mistakes have undermined confidence in the system to the point where Gov. Robert Ehrlich and his opponent, Martin O’Malley, are urging citizens to vote by absentee ballot, rather than risking repeat problems at the polls on Election Day.¹⁷

In Texas and Virginia, voters are finding different problems with summary pages on machines produced by Austin, Texas-based Hart InterCivic.¹⁸ A problem with increased text size means that the summary screen cuts off the names and party affiliations of the candidates; for example, senatorial candidate James Webb will be seen as “James H. ‘Jim.’”¹⁹ Such problems have been reported to Hart InterCivic since 2003; however, the company says the problems will not be resolved until next fall.²⁰ This month, in Florida, problems have been reported during early voting and some machines have had to be taken out of service.²¹ For some citizens, the machines’ summary screen showed different candidates than the ones for whom they voted.²² For example, one man voted for Democrat Jim Davis for governor, but the machine kept telling him that he was casting a ballot for Republican Charlie Crist.²³

There are also problems with the security of the electronic voting systems, according to several recent analyses. The Brennan Center for Justice at New York University found security vulnerabilities in voting systems produced by the three biggest companies -- Diebold, Election Systems & Software, and Sequoia Voting Systems.²⁴ The Center’s analysis and testing found that malicious software could easily be inserted into all three systems, and that machines with wireless capability are vulnerable to a multitude of attacks.²⁵ A study at Princeton University found that one of the most widely used machines, the Diebold AccuVote-TS, is vulnerable to vote-stealing and denial-of-service attacks, especially computer viruses.²⁶ Also, at a Congressional hearing in September, one of the authors of the Princeton study, Edward Felten, professor of computer science and public affairs at Princeton University, demonstrated that he could easily break into a Diebold voting machine, with a commercially available key -- one that is used for office furniture, jukeboxes and hotel minibars.²⁷ Diebold Election Systems President Dave Byrd said the study was “unrealistic and inaccurate,” and that normal election security procedures would prevent such attacks.²⁸

Source: Sequoia Voting Systems

With an optical scan system, a voter fills in the oval or connects an arrow next to the name of the candidate on the ballot, then the voter feeds the paper into the ballot box, which records the vote. About 49% of registered voters will be using optical scan systems on Election Day, according to Election Data Services.

In order to limit such attacks, both the Brennan Center and the Princeton studies recommended modifications to software and hardware of the machines; “parallel testing” (on Election Day, selecting machines at random to test them for problems); the use of voter-verified paper records; and mandatory routine audits of records.²⁹ The National Committee for Voting Integrity, a nonpartisan group devoted to ensuring the accuracy, secrecy and integrity of elections, also has recommendations, including ones for troubleshooting Election Day problems.³⁰

As explained above, Florida residents are facing machines that record their votes incorrectly, showing on the summary page that they voted for one candidate when they actually cast their ballots for another. This shows why voter-verified paper records are necessary. With optical scan machines, there is a paper ballot that can be kept to ensure the accuracy of a vote. DREs create digital records; they do not produce paper records. However, printers can be attached to DREs to create paper records, so that the ballots can be verified. Voter-verified paper records are required in 26 states, but only 12 of those states also mandate routine audits comparing voter-verified paper records to electronic records.³¹

Critics of voter-verified paper records have cited the increased costs, problems with printers jamming, and the possibility of violating ballot secrecy. However, Dr. David Chaum, a cryptographer and the founder of DigiCash, has suggested using encryption to ensure the secrecy of voter-verified paper records.³² Dr. Chaum explains that, with encrypted voter receipts, “In the voting booth, the voter can see his or her choices clearly printed on the receipt. After taking it out of the booth, the voter can use it to ensure that the votes it contains are included correctly in the final tally. But, because the choices are safely encrypted before it is removed from the booth, the receipt cannot be used to show others how the voter voted.”³³ In this way, voters could be sure the results of the election are accurate.

Fundamentally, the problem with the rapid switch to electronic voting systems is the infrequent nature of public elections. They are conducted in most jurisdictions once or twice a year, and the learning curve for the systems is frustrated by this fact. With frequent use, vulnerabilities are discovered in new technologies, and they can be addressed in next-generation models.

Local and state governments are now attempting to address the multitude of problems concerning the security and privacy of such systems. It is too late to make changes for this election, but as we move forward in preparing for future elections, local, state and federal elections officials should look to the recommendations of the National Committee for Voting Integrity, Brennan Center, Princeton University, and Dr. Chaum to help solve these problems.³⁴ Elections officials should continue to work to ensure the integrity of the secret ballot, so they can ensure that every vote counts.

¹ For general information, see EPIC’s Page on Voting, http://www.epic.org/privacy/voting/; the Brennan Center for Justice at NYU School of Law, http://www.brennancenter.org/; and the National Committee for Voting Integrity, http://votingintegrity.org/.

² Funding was set through the federal budgets for Fiscal Years 2003 through 2005.

³ Pub. L. No. 107-252, 116 Stat. 1666 (2002).

⁴ The Election Assistance Commission is an independent, bipartisan federal agency, but it does not have any new rule-making authority; nor does it enforce HAVA requirements, id. The Commission’s Voluntary Voting Systems Guidelines are available at http://eac.gov/vvsg_intro.htm.

⁵ Id.

⁶ Election Data Services, Almost 55 Million, or One Third of Nation’s Voters, To Face New Voting Equipment in 2006 (Oct. 2, 2006), available at http://www.edssurvey.com/files/NR_VoteEquip_Nov-2006wTables.pdf.

⁷ National Committee for Voting Integrity, Optical Scan Technology, http://votingintegrity.org/issues/OpticalScan.html.

⁸ National Committee for Voting Integrity, Direct Recording Electronic (DRE) Voting Technology, http://votingintegrity.org/issues/DRE.html.

⁹ Id.

¹⁰ John McCormick, City withholds voting machine pay, Chicago Tribune, Oct. 25, 2006.

¹¹ Rebeca Chapa, Electronic voting continues to raise questions, San Antonio News-Express, Oct. 22, 2006.

¹² Id.

¹³ Melissa Harris, Diebold machine glitch fixed quietly, Baltimore Sun, Oct. 25, 2006; Cameron W. Barr, Voting Machines Had Defective Part, Wash. Post, Oct. 26, 2006.

¹⁴ Melissa Harris, Diebold machine glitch fixed quietly, supra note 13.

¹⁵ Id.

¹⁶ Melissa Harris, Ehrlich Warns Voting ‘Crisis,’ Baltimore Sun, Oct. 27, 2006.

¹⁷ Cameron W. Barr, Voting Machines Had Defective Part, supra note 13.

¹⁸ Leef Smith, Some Voting Machines Chop Off Candidates’ Names, Wash. Post, Oct. 24, 2006; Tara Copp and Corrie MacLaggan, Did you vote for Hutch? Or St?, Austin-Am. Statesman, Oct. 26, 2006.

¹⁹ Id.

²⁰ Leef Smith, Some Voting Machines Chop Off Candidates’ Names, supra note 18.

²¹ Charles Rabin and Darran Simon, Glitches cited in early voting, Miami Herald, Oct. 28, 2006.

²² Id.

²³ Id.

²⁴ Brennan Center for Justice at NYU School of Law, The Machinery of Democracy: Protecting Elections in an Electronic World (June 2006) [hereinafter “Brennan Center Security Report”], available at http://www.brennancenter.org/Machinery%20of%20Democracy-%20Full%208.8.06.pdf.

²⁵ Id. at 3-4.

²⁶ Ariel J. Feldman, J. Alex Halderman, and Edward W. Felten, Princeton University, Security Analysis of the Diebold AccuVote-TS Voting Machine (Sept. 13, 2006) [hereinafter “Princeton Security Analysis”], available at http://itpolicy.princeton.edu/voting/ts-paper.pdf.

²⁷ Liz Marlantes, Electronic Voting Machines: Not Really a Cure to the Hanging Chad, ABC News, Sept. 29, 2006; Seema Mehta, Secretary of State's Race Not Exactly a Vote Machine, L.A. Times, Oct. 19, 2006.

²⁸ Christian Davenport, Miranda S. Spivack and Cameron W. Barr, Worse to Come in Fall Elections, Officials Fear, Wash. Post, Sept. 15, 2006.

²⁹ The Brennan Center also recommends that elections officials ban voting machines with wireless components, use a transparent and random selection process for all auditing procedures, ensure decentralized programming and voting system administration, and institute clear and effective procedures for addressing evidence of fraud or error, Brennan Center Security Report at 4-5, supra note 24; the Princeton analysis also recommended limiting access to machines and memory cards and effective whole-system certification, Princeton Security Analysis at 18-20, supra note 26.

³⁰ National Committee for Voting Integrity, Securing the Vote Project 2006: National Committee For Voting Integrity's National Campaign For Voting System Integrity (2006), available at http://votingintegrity.org/docs/help/recommend-2006.pdf.

³¹ Brennan Center Security Report at 87, supra note 24.

³² David Chaum, Secret-Ballot Receipts: True Voter-Verifiable Elections, IEEE Security and Privacy, Vol. 02, No. 1, pp. 38-47 (2004), available at http://www.voterverifiable.com/.

³³ Id. at 38; for a model of such a cryptographic voting system, see Stefan Popoveniuc, and Ben Hosp, George Washington University, An Introduction to Punchscan (Oct. 15, 2006), available at http://punchscan.org/papers/popoveniuc_hosp_punchscan_introduction.pdf

³⁴ Other organizations with recommendations for ensuring secure and accurate elections are Verified Voting, http://www.verifiedvoting.org/, and A Center for Correct, Usable, Reliable, Auditable and Transparent Elections (ACCURATE), http://accurate-voting.org/.