Re: Fwd: Voting Methods

[Nicholas Bernstein <nicholas.bernstein@xxxxxxxxxxxx>]

Thanks for your comments. My responses are interwoven.

Please see embedded comments in bold below.

Keep in mind photographic imaging optical scanners that allow viewers to see the physical ballot and filed optical scanned ballot, and how the latter called each vote.

Are these 'viewers' voters or counters? You want the VOTER to know if his/her votes were recorded correctly. Optical scanning would be fine if it were in the voting booth. But if that were the case, it's really no different then a DRE system that prints a receipt that goes in a separate ballot box for recounts.

Also, keep in mind vote marking machines, which allow all the advantages of computer voting equipment -- uniformly legible marking, eliminates over voting and warns of accidental undervoting, multi-lingual capabilities, and allows private, unassisted voting for the disabled -- without the disadvantage of undetectable fraud.

Yes, I agree, it would be difficult to build fraud into a vote marking machine as long as people know to review the markings before they submitted their ballot. But the other side of vote marking is vote reading. And it would be just as easy to build fraud into that as it would be to build fraud into a DRE system. The only ways to guard against fraud are open source code and redundant methods of checking accuracy at each step in the voting process.

First, why are people resistant to DREs?  The core reason is that DREs are susceptible to undetectable, untraceable fraud.  Neither a punch card or paper ballot system suffers that liability.  No voting system is immune to fraud.  But with the old punch card system, teams of people from opposing parties can look at each punch card and determine the voters' intent.  So with paper ballots.

My comments above still apply. Fraud is equally easy or difficult to implement in either system. I disagree with your statement that people of opposing parties can determine a voter's intend. They can only determine what was physically marked on the ballot. Only the voters can determine their own intent. This is why the voter must be able to preview exactly how their ballot will be counted BEFORE they submit it. This absolute certainty is a digital phenomenon, no analog system of demarkating intent can provide this.

...problem results from the basic contradictory voting system requirement that ballots be both secure and anonymous.  At the point when a DRE (or optical scanning system) accepts and stores a ballot, it "scrambles" it with all the other ballots, so no one can go in later to see how a particular person voted.  This is good because it ensures anonymity.  But it is at this scrambling point that hidden bugs work, and it could be impossible to determine whether or not the scrambling was or was not done without any altering of voter intent.

Right you are. But just because the system requires anonymity, doesn't mean votes are identical. The lottery is a great example. You can buy a lottery ticket with cash and you essentially get a receipt of your purchase (each ticket purchase is regestered with the lottery commission so they can guard against fraudulent claims). When the results are announced, ONLY THE RECEIPT HOLDER KNOWS WHO HE/SHE IS even though the total number of winners and their earning are known by the lottery commission.

Optical scanning is also equally susceptible to hidden, self-erasing bugs.  That is why at the very least optically scanned ballots should be cross checked by statistically relevant hand-counted sample batches.  Some say all ballots should be hand counted, period.

Checking ballots by hand is fine and good to double check your system. But ONLY checking ballots by hand is foolhearty. Yes, a computer system could erase votes. But at least in open source code; the saavy sleuth can look through the code and determine exactly what the code is doing. And it will do the exact same thing every time. You don't have this same luxury with people.

Let's continue this ATM analogy. At the end of every month your bank sends you your statement. If you balance your checkbook with pencil and paper when you get this statement, you probably come close to what the bank gets. If you're off by a dime, you probably don't worry, because chances are, you made an arithmatic error. If you get exactly what the bank got, then you're really confident that you did your math correctly. Next month, balance your checkbook by hand without checking your statement. Do the arithmatic twice to double check. Now ask yourself. "How confident am I that I will have correct answer, to the penny?" Then look at your statement--and I'll bet you, dollars to donoughts, you'll be off. 

To allow individuals to leave precincts with physical proof of how they voted opens up that nasty can of worms again.  That would be dangerous and would sooner or later lead us back to voter intimidation and vote buying.  Just as mail ballots will, sooner or later.

Yes, we agree that mail ballots are a bad idea. There are several ways to get around taking something PHYSICAL out of the voting place. But when it comes down to it, you have a double-edged sword. If you don't allow voters a way to validate their vote after the election, then you can never be sure if your vote was counted. If you do, then vote buying could return as a problem. I think the best compromise to this is allowing people the OPTION of taking some sort of receipt with them. I guess your personal choice depends on who your distrust more, the voters or the vote counters.

Good point.  Just because it's paper doesn't mean it will be counted.  However, after more than a hundred years experience with various forms of paper balloting, there are some pretty good rules of thumb that make vote losing/stuffing of paper ballots very difficult, even next to impossible.  The key is citizen participation.

Digital technology allows you to simulate more than a hundred years of experience before it ever goes only. If we had been able to simulate paper ballot technology, the Florida recount scenario surely would have come up before it happened.

In Boulder County, the precinct typically/ideally has about 6 or 7 election judges (from both major parties) physically with the ballots and the ballot box all day.  You eat lunch by it.  You never leave except for a bathroom break, while all other judges remain with the ballots.  Citizens stay with those ballot boxes the entire day and until they are counted, relocked, and securely stored.  With healthy citizen participation, losing ballots becomes very, very unlikely.  So does ballot stuffing.  It's a system that works.

OK,  it MAY work fine in Boulder, but the average person will never know. You put your faith in the honesty, integrety, and ability of those 6 or 7 people.

Would similar levels of citizens participation prevent fraud on DREs and servers?  In theory, but the problem is that there would be no way for anyone to know for sure.

Why not? Open source code is OPEN i.e. anyone can look and see what's going on.

  With paper ballots, we can always go back and check.  With DREs, we can't.  With DREs there is back up, no recount.  Only a paper ballot provides that.

Use receipts. That provides your recount ability. And there are any number of ways to do instant backup. Data backup is a well tred field. What happens if there is a fire in your voting place. Where's your paper ballot backup? With DRE you could copy your data to onsite and offsite servers to ensure that no one copy is compromised.

Also, w/ DREs, only experts (say 1 in 800,000 people) would have the sort of software security expertise to even pretend to be able to go back and competently check for traces of fraud. 

I can find 4 people in my lab that could do it. Let's see, there are one or two upstairs, I would imagine all 6 of the guys over in UNIXOps could handle that. Overall I'd say I could probably find 100 people just in the engineering building here. Now granted, we're not infallable. But open source code is open to anyone. The best minds in the world have put in their two cents into open source security. If other districts (or states, or nations) are interested in using similar technology, they will all have a stake in producing bulletproof code.

Ordinary citizens should be able to check for fraud.

Thats the reason for the receipt.

The bottom line for elections is fairness, security, accuracy, and anonymity.  Why change from a paper system that provides that?  The main reasons are convenience for election officials and quicker reporting.  But convenience and efficiency are utterly worthless without fairness, accuracy, security, and anonymity.

Paper ballots provide notoriously poor accuracy and its security is dubious. A DRE system COULD provides all of these and more.

Nick