Re: New NIST draft on VVPATs and DRE audits; Holt bill

[Neal McBurnett <neal@xxxxxxxxxxxxxxxxx>]

Thanks for your feedback, Al - it helps a lot.

On Mon, Mar 07, 2005 at 10:49:49PM -0700, AlKolwicz wrote:
> http://coloradovoter.blogspot.com/2005/03/say-no-to-nists-voter-verification.html 

which says:

> The NIST draft is a step backward.

Certainly not a step backward from the present.  Is there a proposal
you support, and a strategy for getting it into law here in Colorado
real soon now?  Unless something passes in the next month or so, I
think a whole lot more pure-DREs are likely to be bought to comply
with HAVA, and used for a long time.

> 1. It does not require that the votes on the voter verified ballot
> be the official votes that get counted. Consequently, it is little
> more than a mechanism to deceive voters into thinking that voters
> are verifying their votes.

Note that the NIST draft is about what the system should be able to
do, and does not specify any law.  In fact this is input for a
voluntary standard and they can't define a mandatory standard.

The Holt bill, which I also cited, does require that the paper records
be the "true and correct record of the votes cast"

Like you, I would reject either requiring that the machine count
be the official count, or letting official choose between two
different subtotal counts.

But note that the NIST draft mandates that individual paper records
be identified by random serial number (invisible to the user) so they
can be matched to the electronic records.  This allows the election
officials to recover the vote on a damaged piece of paper by looking
at the electronic record, or to use an electronically signed paper
ballot in a case where the electronic ballot is missing, or to choose
what to do given a conflict.

It's basically like the truely private serial numbers that Paul
Walmsley and I have wanted in order to do really good manual tally
audits with a "batch size" of one.

Specifically, the draft says:

> mandating that the paper record shall always be trusted over the
> electronic record (or vice versa) may not result in greater
> accuracy. ....
> This suggests that the paper record and the electronic record should
> be treated as two separate but equal representations of voter's
> choices.
>
> The DRE-VVPAT design contains specific capabilities for making the
> audit of its records more accurate and easier to accomplish. It
> marks the paper ballots with information concerning the election and
> voting precinct, and includes as well an identification of the
> specific DRE-VVPAT. It maintains a one-to-one correspondence between
> its paper records and electronic records by including a unique
> identifier for each record pair. It also prints the paper record
> such that it is machine-readable.

Al writes:
> 2. It requires that the voter be able to compare the votes on the
> paper to the votes in the computer -- which as far as I can tell is
> not possible. "To permit the voter, at the time of voting, to verify
> that the DRE-VVPAT is recording the electronic ballot choices
> correctly and to resolve problems should they occur,"

I agree that isn't good wording, but it certainly requires that
the voter be able to reject the paper that was offered and correct
the ballot, so I don't see the practical consequence.

> 3. Several members of the IEEE committee on Voting Systems objected
> to this solution and provided many arguments against it.

Where would I find those arguments?

> As far as I can tell, this draft is another attempt to protect DRE
> vendors and election officials who have purchased DRE equipment, and
> is not an attempt to achieve the highest level of election security,
> accuracy and verifiability.

ADA and HAVA and my own sense of justice clearly require some sort of
machine to provide private, independent, accessible voting to all.

This question seems to come down to whether the paper is a ballot or
an audit trail (covered in the previous discussion), and whether
any electronic ballot is allowed.

I think that NIST is forced to provide an option for existing
jurisdictions that choose to go with the redundancy of "two separate
but equal representations of voter's choices", and an argument can
certainly be made for that.

If we get a "no electronic ballot" law passed, we can just do away
with them.  But unless we also get a pure hand count law passed, we're
still left with de-facto electronic ballots after the batch/machine
counts are fed into the tally computers, so we still need good
manual tally audits.

From what I've seen, the accessibility community is pushing very hard
against the sort of ballot marking device I've supported for a while,
e.g. ES&S's Automark, since it requires a mobility-impaired voter to
somehow privately transport the ballot to the ballot box.  Or does
the Automark include a ballot box as part of the booth, like a
DRE-VVPAT does?

Cheers,

Neal McBurnett                 http://bcn.boulder.co.us/~neal/
Signed and/or sealed mail encouraged.  GPG/PGP Keyid: 2C9EBA60

Neal wrote:
> Preliminary Report: NIST Approach to VVPAT Requirements for the VSS
> 2002 Addendum (John Wack)
> http://vote.nist.gov/TGDC/VVPAT%20Addendum%20-%20jpw%20-%203-2-051.pdf