> On Dec 17, 2003, at 12:16 PM, Nicholas Bernstein wrote:
>
>> Joe,
>>
>> Thanks for the quick response. I just watched the streaming video and
>> I understand where you are coming from. However, I still oppose the
>> use of paper ballots. Ultimately, all physical methods of of
>> recording voter intention suffer from the same problems; optical
>> scanners will never be 100% accurate, erroneous marks as well as
>> undervoting and overvoting will not go away until we have a digital
>> way of recording voter intent.
Keep in mind photographic imaging optical scanners that allow viewers to see the physical ballot and filed optical scanned ballot, and how the latter called each vote.
Also, keep in mind vote marking machines, which allow all the advantages of computer voting equipment -- uniformly legible marking, eliminates over voting and warns of accidental undervoting, multi-lingual capabilities, and allows private, unassisted voting for the disabled -- without the disadvantage of undetectable fraud.
>>
>> As you point out in your presentation, people are leary of DRE
>> systems. But people were also leary of ATMs when they came out. That
>> doesn't mean that DRE system are bad. It means that some effort will
>> be required to restore that confidence. Open source code, extensive
>> review, and clear explanations will address this public resistance.
>> And yes, bugs exist in every system. But proprietary optical scanning
>> code is just as succeptable to errors than open source DRE software,
>> if not more so.
First, why are people resistant to DREs? The core reason is that DREs are susceptible to undetectable, untraceable fraud. Neither a punch card or paper ballot system suffers that liability. No voting system is immune to fraud. But with the old punch card system, teams of people from opposing parties can look at each punch card and determine the voters' intent. So with paper ballots.
But you cannot do that with digital ballots: a cleverly hidden and/or self-erasing ballot can remain undetectable no matter how thorough an investigation of the code before, during, or after an election. This problem results from the basic contradictory voting system requirement that ballots be both secure and anonymous. At the point when a DRE accepts and stores a ballot, it "scrambles" it with all the other ballots, so no one can go in later to see how a particular person voted. This is good because it ensures anonymity. But it is at this scrambling point that hidden bugs work, and it could be impossible to determine whether or not the scrambling was or was not done without any altering of voter intent.
Optical scanning is also equally susceptible to hidden, self-erasing bugs. That is why at the very least optically scanned ballots should be cross checked by statistically relevant hand-counted sample batches. Some say all ballots should be hand counted, period.
Bear in mind that there is a big difference between ATM machines and DREs. They have two completely different goals.
ATMs have multiple redundancies to prove everything that happened on the machine, key stroke by key stroke. They even give receipts and have a video camera to record anyone who approaches within 5 feet. They are designed to provide very high levels of security and very low levels of anonymity.
Contrarily, DREs must provide a high level of anonymity, but doing that compromises security. Once the DRE begins its scrambling process, there's no way to determine key stroke by key stroke if the vote is recorded with absolute accuracy. Hence, the demand for paper.
>>
>> The intent of the Colorado Recount Law is a good one. Unfortunately,
>> the letter of the law is a little stricter than the spirit of the
>> law. Every business in this country accepts a receipt as proof of
>> purchase. You don't need to physically mark your money or show your
>> checkbook to prove it. Why shouldn't a voting receipt be just as
>> valid? Instead of just accepting the Colorado Recount Law as it
>> stands, I believe that we should be working to have it include
>> receipts as acceptable media for a recount.
>>
>> I don't understand your opposition to taking a receipt out of the
>> voting place. There are garbage cans in polling places. No one can
>> force you to take a receipt. In fact printing them could be entirely
>> optional. Vote buying can exist now. This system may not stop it, but
>> I don't believe it encourages
it.
Vote buying and voter intimidation are all but impossible if the voter cannot actually prove how s/he votes. Who is going to give me $25 bucks for my vote if he can't know for sure I voted the way I claim I voted?
Anonymous ballots were a cornerstone of Progressive Era electoral change in the later 1800s and early 1900s. Up until then, vote buying and voter intimidation was part and parcel of elections. However, increasing numbers of people thought that practice corrupted basic democratic principles; they thought that citizens should vote based on the merits, not because someone offered them money or threatened to bust their kneecaps.
To allow individuals to leave precincts with physical proof of how they voted opens up that nasty can of worms again. That would be dangerous and would sooner or later lead us back to voter intimidation and vote buying. Just as mail ballots will, sooner or later.
As far as the 'cryptic
>> single-character indications', a receipt could contain as much or as
>> little information as desired (remember we're talking about an
>> electronic system). The system we currently have doesn't have ANY way
>> for a voter to ensure that their vote has been counted. This is a
>> huge improvement. Mail-in ballots are particularly bad in this case.
>> Any postman could 'lose' mail from a part of town known to vote a
>> certain way on an issue, and no one would know that their ballots
>> weren't counted. But this can also happen in polling place voting.
>> Remember those ballot boxes that were found in the basement of the
>> polling place in Florida a week after the election? Voters need a way
>> to ensure their vote has been counted. This will provide the 'public
>> confidence' you seek.
Good point. Just because it's paper doesn't mean it will be counted. However, after more than a hundred years experience with various forms of paper balloting, there are some pretty good rules of thumb that make vote losing/stuffing of paper ballots very difficult, even next to impossible. The key is citizen participation.
In Boulder County, the precinct typically/ideally has about 6 or 7 election judges (from both major parties) physically with the ballots and the ballot box all day. You eat lunch by it. You never leave except for a bathroom break, while all other judges remain with the ballots. Citizens stay with those ballot boxes the entire day and until they are counted, relocked, and securely stored. With healthy citizen participation, losing ballots becomes very, very unlikely. So does ballot stuffing. It's a system that works.
Would similar levels of citizens participation prevent fraud on DREs and servers? In theory, but the problem is that there would be no way for anyone to know for sure. With paper ballots, we can always go back and check. With DREs, we can't. With DREs there is back up, no recount. Only a paper ballot provides that.
Also, w/ DREs, only experts (say 1 in 800,000 people) would have the sort of software security expertise to even pretend to be able to go back and competently check for traces of fraud. Ordinary citizens should be able to check for fraud.
I don't know enough about "cryptic single-character indications" to comment. But several of the more technically savvy members have rejected similar systems proposed thus far, I think mainly because they ultimately can't prove how voters voted, open the door to voter intimidation/buying, or both.
The bottom line for elections is fairness, security, accuracy, and anonymity. Why change from a paper system that provides that? The main reasons are convenience for election officials and quicker reporting. But convenience and efficiency are utterly worthless without fairness, accuracy, security, and anonymity.
>>
>> Lastly on a somewhat different topic, I hope your group does not end
>> up endorsing instant runoff voting (IRV). IRV provides the illusion
>> of fairer voting, but in reality suffers from a number of problems,
>> including the paradox that sometimes voting FOR your candidtate of
>> choice can actually cause him/her to LOSE the election. Check out
>> electionmethods.org for an explanation. A quick read will explain why
>> Approval Voting or Condorcet (Pairwise comparison) are much better
>> systems.
Thanks for the heads up on Approval Voting. One of our members recently explained that to me and it looks well worth investigating. It might be better than IRV.
If anyone disagrees, or thinks I err, please feel free to comment. I'm always open to revision.
kell
>>
>> Nick
>>
>>
>
> Nick-
>
> Thanks for getting in touch, I'm sorry we haven't seen you at our
> meetings and I hope you'll join us next time (we don't have a meeting
> scheduled now, we're awaiting the Commissioners Public Hearing).
>
> Unfortunately, due to Colorado Recount Law (CRS 1-10.5-108) as it
> stands, only Paper Ballots will give you the audit trail that you are
> seeking. Otherwise, if the count is conducted by DRE, then any recount
> is required to be conducted using the same method, unless the Secreary
> of State or a court of competent jurisdiction were to intervene, and
> as you can imagine, we don't want our Democracy hanging on that. That
> is, your audit trail receipts will never be looked at. We are also in
> contact with Congressman Holt, Senator Graham, and Colorado State
> legislators Madden
and Keller regarding legal remedies to the voter
> verification issue and modification of State election law reform to
> clarifiy the validity of an paper receipt.
>
> Our group has been working on this issue for months and we have
> examined many systems, including some that have concepts similar to
> yours -- I can't remember the name now but there is a prominent crypto
> researcher who has a very similar concept with a two-part ballot.
> Also, there are concerns about being able to leave the polling place
> with an official record of how you voted, which could lead to vote
> buying. Plus, you also would not want people to hold a slip of paper
> in their hands that has only cryptic single-character indications
> about how they voted, did you really mean to vote "Y" on 204, wouldn't
> you want to see the full text of the issue to verify that's how you
> wanted to vote?
>
> We
have become lay experts at HAVA, Colorado HAVA, Colorado Election
> Law and our group(s) in Boulder and Denver also consist of members of
> both the IEEE and NIST groups looking at the systems.
>
> We are not luddites, most of our members are high-tech professionals,
> and we have come to the conclusion after months of research that a
> single voter-verifiable, full-text, physically marked Paper Ballot is
> the only acceptable solution, and I hope you will find a wealth of
> information on our site to understand how, after all this research, we
> arrived at that answer.
>
> Many people around the country have commented that our 10-minute
> presentation to the Commissioners is among the most clear explanations
> of our position of any citizen's group in the Country.
>
> The streaming video is available from our website at:
>
>
>
> Where you will also find archives of our mailing list (which I hope
> you will join), MP3 audio and PDF slides of the presentation, and much
> more. I would also suggest you check out the Declaration, for which we
> have secured the endorsement or support of all four of Boulder
> County's political parties.
>
> Also, please bear in mind that concerns about DREs are only one of
> many issues related to problems with EVoting, for example, the Denver
> Group (Coloradans for Voting Integrity) is also looking at the
> ePollbook issue, which is attributed with dropping tens of thousands
> of eligible voters from the rolls in the Florida 2000 election (do a
> search for "ChoicePoint and Katherine Harris").
>
> I hope this is useful to you, I'd be glad to talk in person at our
> next meeting, and you will find that we have a number of extremely
>
knowledgeable and insightful folks who have been looking at these
> issues for quite some time, more than a decade in some cases.
>
> Again, thank you for getting in touch, please don't hesitate to
> contact me if you have any additional questions.
>
> Sincerely,
>
> Joe Pezzillo, Spokesperson
> Boulder County Citizens for Verifiable Voting
> http://www.coloradovoter,net
>
> personal public e-mail: jpezzillo@xxxxxxxxx
>
> cc: Tom Halicki
>
>
> On Dec 17, 2003, at 8:47 AM, Nicholas Bernstein wrote:
>
>> Joe,
>>
>> I just talked to Tom Halicki and he suggested I get in contact with
>> you. I'm concerned that the push for paper ballots and optical
>> scanners is misdirected. I have an idea that addresses CVVs concerns
>> and has all the benefits of a DRE system. I've sent my ideas to
>> Congressman Rush Holt,
but I would love to share these idea and get
>> feedback on a local level as well.
>>
>> In short, my idea has two parts
>> 1. Open source code
>> Any code used in the voting should be fully open source. There are
>> enough volunteers that would write code for free. Benefits:
>> A. save money B. ensure robust code through peer review
>> (i.e. no hidden code)
>> C. get more people involved in politics
>>
>> 2. Voting Receipts
>> A DRE system would work fine as long as you can ensure two things:
>> the votes were recorded accurately, the votes were tallied properly.
>> This can be done effectively with printed paper reciepts. Each voter
>> would receive two receipts with a unique randomly generated voter
>> number. One receipt would be dropped into a ballot box in case a
>> recount is needed (which would be rare in a DRE
system). The second
>> could be held by the voter and checked against a public list of votes
>> (listed by anonymous voter number). This method of receipts provides
>> significant advantages over all the current and proposed systems that
>> I've heard about.
>>
>> I'm very interested in your thoughts on this,
>>
>> Nick Bernstein
>>
>>
>>
>>
>