Voting on Paper Ballots

Overview

The classic Australian of paper ballot provides an excellent introduction to the system of checks and balances used to assure voter privacy and an accurate vote count in the face of a variety of threats. In this system, first used in the province of Victoria, Australia in 1858, voters are issued paper ballots at a polling place, and after the ballot is marked, voters deposit it in a ballot box. After the polls close, the box is opened, the ballots are counted by the election judges, and the totals are reported.

On the face of it, this system looks misleadingly simple, but the fact that this system was first introduced in the mid 19th century and the fact that it took decades before variations on this system to be adopted by other jurisdictions is strong evidence that this was not a trivial invention!

The threats that must be accounted for in a paper ballot election include ballot box stuffing and dishonest ballot counting. In addition, we must guard the privacy of the voter, so that voters are not subject to harassment (or worse) because of the way they cast their vote.

An analysis of the problem of carrying out an honest election begins with an enumeration of the different parties in the process. For each party, we identify of the threats that party poses and the countermeasures we can take to meet these threats. Historically, the identification of threats has frequently developed very slowly, with each threat being clearly addressed only after serious improprieties have been widely publicized. Many paper ballot voting systems in use today fail to address several threats, and even in the realm of paper ballots, technological changes threaten some of the countermeasures that have traditionally proven to be effective.

• The rules given here governing the conduct of an election are not intended to represent the rules used in any particular jurisdiction, but rather, these rules are but one example of a reasonable refinement of the Australian ballot.

The Parties

The primary parties that interest us are the voter and the election judges, but we are also interested in several others. One important party is the outsider who tries to buy votes. Another is the agency that prints the ballots, and finally, we are concerned with assuring the security of ballot transportation and storage.

The Voter

The first party we care about in any election system is the voter! Nobody should be allowed to vote who is not entitled to vote, and nobody should be allowed to vote more than once.

• Traditionally, these two requirements have been enforced by maintaining a voter registration list at the polling place and checking off each voter on the list as they vote. One of the primary responsibilities of the election judges at the polling place is to handle this job.

There is a tradeoff between a rigorous test of voter identity, on the one hand, and a voting system where polling places are pleasant, open and inviting to voter participation. A rigorous test of voter identity could well prove sufficiently inconvenient or even humiliating that legitimate voters refuse to participate! On the other extreme, if voter identity is subject to no verification, we have no reason to believe that the election results reflect the will of the electorate.

It is probable that a system relying on imperfect tests of voter identity in order to maintain a pleasant atmosphere at the polling place will most accurately reflect the will of the electorate even though it tolerates a modest level of fraud. This will be true when the increase in legitimate turnout resulting from relaxed identity checking more than offsets the resulting increase in fraud.

Many jurisdictions do not require the voter to present any form of ID card. This may seem dangerously open to voter fraud, but there are remarkably simple countermeasures that offer what we usually consider to be adequate security. For example, if we selectively hire election judges from within the precinct, there will be a high probability that one or more judges will actually know many of the voters, making more formal identity checks unnecessary.

When the voter requests a ballot, we typically require that the voters name and address be announced so it can easily be heard by all present. If a person tries to impersonate a legitimate voter or claim residence at some address, there is a real risk that some other voter, perhaps a neighbor, will notice! Asking voters to sign a form certifying that they are indeed legitimate voters in the precinct, we gain additional security by forcing a voter intent on fraud to commit the added crime of forgery in front of a large number of witnesses.

If we assure that each voter is only allowed one trip to the voting booth and ballot box, we still have not prevented the voter from casting multiple ballots! A voter could, in theory, smuggle a stack of ballots into a polling place and stuff the lot in the ballot box! This threat is met by two countermeasures:

• We require that the ballot box be out in the open, in clear view of all of the election judges and of other waiting voters, so that any attempt to stuff the ballot box would be difficult to conceal.
• Second, we institute a system of strict accounting for all ballots issued and voted, and we print ballots in such a way that they are at least modestly difficult to counterfeit.

The accounting for ballots typically involves reconciling the number of ballots found in the ballot box at the end of the election with the number issued to voters during the voting period and the number stocked at the polling place at the beginning of the election. At the end of the day, all ballots must be accounted for as either voted, spoiled or never issued.

An interesting conflict arises between the problems of accounting for ballots and the problem of allowing voters to cast secret ballots. A classic accounting method involves attaching serial numbers to each ballot and recording these numbers whenever ballots are distributed or handled.

In order to allow secrecy, ballot forms that include serial numbers are typically prepared with a perforation between the main ballot and the tear-off tab where the number is printed. Typically, this tab is torn off by the election judge at the time the ballot is given to the voter, and at the close of polls, the number of torn tabs must equal the number of ballots cast or spoiled.

The Outsider Trying to Buy Votes

We must protect voters from outsiders who might try to punish those who vote "the wrong way" or reward those who vote "the right way". To protect voters from punishment, we must assure the voter that his vote is secret. To protect the public from voters willing to sell their votes, we must be assured that even the voters themselves cannot prove how they voted in order to claim a reward.

• Ballot secrecy requires that the ballot contain no marks that could be used to identify the voter. Neither preprinted information such as a serial number nor any kind of personal identification such as a signature can be allowed on the ballot. When it comes time to count the ballots, the election judges must reject any ballot containing such information.

Additionally, because both the deposit of ballots in the ballot box and the counting of ballots are done openly, we must defend against an observer who notes the the order in which people cast ballots, and then, later, notes the the votes in the order that they are counted. Voter privacy will be compromised if these two processes are related!

• We therefore require that the votes not be counted in the order they were deposited! Ballot boxes should not be designed so that the ballots stack neatly and in the order they were deposited, and when the ballot box is opened for counting, its contents should be dumped into a disorderly pile on the counting table and not handled in neat stacks that preserve their order.

An interesting approach to buying votes involves offering voters pre-voted ballots, along with the promise to buy a blank ballot from any voter who returns from the polls with one. While the voters are in the privacy of the voting booth, they are guaranteed to have ample opportunity to exchange their pre-voted ballot they smuggled into the polls for the blank ballot that was given to them by the election judges.

This scheme requires only one blank ballot to start with. After this is marked and deposited by the first voter, the perpetrator buys a blank ballot from that voter, marks it, and gives it to a second voter. Thus, a single blank ballot may be used to buy a large number of votes during the course of an election day.

This is an example of a vote fraud scheme that only works in the presence of partial security measures. If blank ballots are freely available, the perpetrator has no way of knowing how the voter got a blank ballot. If blank ballots are impossible to get, there is no way to get the single blank ballot needed at the start of the day to begin the scheme. If there is no polling place security, the perpetrator would have no need to pay voters to vote, while if every voter was searched on the way in and out, smuggling pre-voted ballots in and blank ballots out would be impossible.

Clearly, we cannot impose intimidating searches on voters; too many would be driven away, so we must concentrate on preventing blank ballots from reaching those intent on committing large-scale vote fraud. We typically do this by using ballots that are difficult to forge combined with strict accounting for all ballots printed.

Of course, few ballots are printed with the kind of anti-forgery measures that are involved in the printing of, for example, paper money; nonetheless, use of special cardstock and the distinctive print quality of letterpress printing have traditionally been judged to provided sufficient security.

The Election Judges

The election judges run the polling place and, in a precinct count system, they count the ballots. If the election judges are dishonest, they can fix the election any way they want, for example, by excluding registered voters, allowing non-registered voters to vote, stuffing the ballot box with extra ballots, discarding ballots that vote against the position they support, or simply reporting vote totals that are fictional.

We use several tools in order to guard against such fraud. Of these, the most important is openness. At no time during the conduct of the election are the judges allowed to take any action in private. For example:

• As each voter is checked against the list of registered voters, the election judge is required to call the name out, loudly enough that all present can hear.

This allows others present, for example, election observers, to record the names of those who voted and compare the names with lists of eligible voters, and it gives a chance for those who may know the voter by name to recognize that an impostor is attempting to vote.

• To prove that the ballot box is empty before the polls are opened, the election judges open the box and display its empty interior prior to the opening of the polls, and then close and seal it.
• For the full time between the public proof that the ballot box is empty and the time the box is opened for ballot counting, the box remains sealed, and in addition, it remains either in public view or in secure storage and transport; it is never in the private custody of any one person or party.

When the polls close, ballot counting must be equally open. We cannot trust an election in which we allow the ballot counting to be carried out in private, behind locked doors.

• We therefore require that all ballot counting be done openly, from the time the ballot box is opened and its contents dumped out for counting until the time the official totals for the precinct are publically posted.
• In order to account for all ballots printed, the count must include a the number of ballots remaining unvoted, the number of ballots spoiled by voters and replaced at the polling place, the number of spoiled ballots found in the ballot box, and the number of valid ballots actually counted.

Additional auditing of the counting process is possible if, for each race, in addition to counting the number of votes for each candidate, the number of overvotes and undervotes is also counted. Undervotes occur when voters fails to cast votes in a race, while overvotes occur when voters mark more than the permitted number of alternatives. In simple races, the sum of overvotes, undervotes and votes cast should add up to the number of ballots deposited in the ballot box. Slightly more complex accounting allows a similar check on races where voters may vote for more than one candidate.

• The requirement for open election administration may be met by literally inviting the public, but when this leads to crowding that threatens to interfere with the election, we must back away and limit attendance to representatives of the public.

As an example, it is common for political parties and campaign organizations to assign volunteers to monitor polling places, noting the names of those who have voted. In addition to supporting partisan "get out the vote" drives, these observers serve as representatives of their organizations to monitor the conduct of the election judges.

When the ballot boxes for a multiple-precinct jurisdiction are checked and sealed at a central location before being distributed to the polling places, and when full ballot boxes are taken to a central location for counting, we typically achieve a degree of openness by allowing each political party or campaign organization to send a limited number of representatives as observers.

The selection criteria used for designating the election judges who will administer the polling paces, set up the ballot boxes and count the votes provide an additional check. If we allowed one party to control the makeup of these panels that run each polling place, we would open the process to fraud. Therefore, an open election system must prevent this.

• We typically require that, to the extent possible, the judges for each precinct be residents of that precinct. This ensures that many of the judges will recognize many of the voters.
• In addition, we require that, to the extent possible, members of opposing factions or political parties be represented in the panel of judges for each precinct.

It is frequently impossible to meet both requirements; some precincts may have an insufficient number of qualified people able to work on election day, while others my be so dominated by one or another party or campaign organization that balance cannot be achieved.

• Therefore, we typically provide a mechanism whereby parties and campaign organizations can suggest judge candidates for each precinct, and the list of judges appointed is made public prior to the election, so that, if qualified people are overlooked or the panels are stacked in favor of one party or campaign organization, a court challenge is possible.

In the United States, with our longstanding of two-party political tradition, election laws frequently mandate openness by requiring that members of both major parties be included on the panel of election judges, or that representatives of both major parties be invited to be present as observers during ballot box inspection and ballot counting.

Clearly, such wording is not acceptable. In the first place, in some jurisdictions, there are significant third parties that ought to be allowed representation. In some elections, there are nonpartisan races that may be supported by campaign organizations that should be allowed representation, and in jurisdictions dominated by a single party machine, opposing factions within that party ought to be allowed representation, particularly in primary elections.

Therefore, to the extent possible, we should not talk about representatives of the two major parties, but rather, representatives of each party or campaign organization.

Voters can inspect their ballots to see if they have been pre-marked, but such checking can be quite tedious, particularly if the ballot includes large numbers of issues that most voters would rather ignore. In addition, after the ballot is deposited in the ballot box, we must assure voters that no additional marks are added! Therefore, nobody but the voter must be in a position where they might be tempted to add marks to a ballot!

• To meet this requirement, we forbid those who handle ballots from doing so within reach of pencils, pens or other marking devices! Election judges who distribute ballots or interpret ballots must be clearly distinguished from those who mark off voter names on the list of eligible voters or who make tally marks as the votes are counted.

Furthermore, election judges themselves could attempt to buy votes by asking voters to mark their ballots in a distinctive way in order to identify themselves to the judge actually reading that ballot.

• To prevent this, we ask the judges to reject all ballots containing any stray marks; that is, any marks that might serve any purpose other than indicating an anonymous vote for a candidate.

The rejection of ballots containing stray marks imposes a very strict standard on the prohibition against ballot handlers having any marking implements on them. If dishonest ballot handlers are able to mark ballots, on seeing ballots containing votes for the wrong candidates, they could invalidate them by making random marks.

Taking this to an extreme, dishonest ballot handlers have been known to carefully park fragments of pencil lead under their fingernails, allowing them to mark a ballot by casually dragging a fingertip across it. To counter this, election officials in some jurisdictions have been known to require careful inspection, trimming and cleaning of fingernails prior to any ballot handling.

The combination of the openness requirement and this requirement sets the minimum effective size for the panel of election judges, both at precincts and in vote counting centers.

• We need at least two judges, preferably from opposing factions, who actually handle the ballots, distributing them to voters or inspecting them and calling out their interpretation of each vote. Independently from them, we need at least two judges, again, preferably from opposing factions, to mark off names in the lists of eligible voters and to maintain the tally sheets during counting. If there is a dispute or confusion, we need an odd number of judges to break ties, so we need at least five judges on the panel.

In any case, in any multi-precinct election, after the results for one precinct have been computed, they must be accurately incorporated into the totals for the election district. This necessarily involves communication from precinct to regional to state offices, where successive subtotals are computed, and with each step, errors are possible, whether deliberate or accidental.

• As soon as the judges counting the votes for a precinct arrive at a count that is consistent, that is, a count that properly accounts for all ballots cast and where the sums for each candidate are consistent with the numbers of ballots cast, the results must be publically posted.

This allows observers to reconcile the numbers with their own observations of the counting, and it permits observers to check the official district-wide totals by independently computing them.

No requirement for openness or public posting of results is of any use unless there is some way to challenge an incorrect result and request that the ballots be re-counted. It is conceivable that an informal demand for a recount could be handled on the spot, but if this were done, it would be possible for an observer to arbitrarily delay the completion of the canvass of an election by repeated informal requests for recounts.

• Therefore, there must be a formal mechanism for requesting a recount; outside this formal mechanism, no recounting should be done once an official total has been posted.

If we allow a recount request at any time, it would be possible for someone to overturn a close election at any time, possibly long after someone has begun serving in office. In the event of a close election, lingering doubts about the outcome could paralyze the government.

• Therefore, we impose a deadline on the right to request a recount. This deadline must be long enough after the election to allow any questions about the propriety of the process or correctness of the results to be raised, and it must be before the term of office begins for the winner of the election. After this deadline, the election is declared final and no further challenge is allowed.

During the interval between the announcement of the official totals and the end of the period during which recounts are allowed, we must store all ballots for possible re-counting.

• Therefore, after counting, all ballots and all records from the polling place must be placed in secure storage, under lock and seal. Not only the ballots that were counted, but also spoiled ballots and ballots rejected during counting should be saved. Not only the lists of voters who voted must be saved, but also all ballot stubs, so that every ballot issued can be accounted for.
• At the end of the recount period, the stored ballots are typically destroyed, thus making any attempt to initiate a recount outside the recount period moot.

This final requirement does not mean that the candidate may not be impeached, subject to recall, or otherwise removed from office, but rather, it removes such a removal from the domain of election law.

Rules Governing Ballot Interpretation

The election judges are constrained by the laws and administrative rules imposed by the government. In the this presentation, a number of suggested regulations are presented, but these are general procedural rules. The one area where these rules are the least obvious and the most critical to the outcome of the election where the rules govern the admissibility of ballots and of individual votes on ballots.

One approach to this problem is to simply leave ballot interpretation to the election judges. This approach is sometimes classified as the "clear and obvious interpretation rule." Here, we give the election judges the authority to interpret, as a vote, any mark on a ballot which indicates the clear and obvious intent of a voter to cast a vote for one or the other candidate.

The most obvious problem with this is that it seems to give the judges a huge amount of leeway as to what marks they interpret as votes, but by requiring that election judges work in pairs, where each pair contains representatives of opposing parties, and by requiring that observers be allowed to closely observe each pair of judges, clearly biased judgements will be very difficult to hide.

A less obvious problem with this is that it allows voters to "sign" their ballots by use of a distinctive marking method. A voter could vote by initialing the box where a mark is intended, or a voter could record a binary code using Xs and check marks to represent ones and zeros, with one bit of data per office on the ballot (a long judicial retention ballot would allow for thousands of distinct codes!).

• To prevent encoding of voter identity on a ballot, we typically require that votes be indicated by some kind of standardized mark, for example, an X within a box of standard dimensions provided beside each candidate name or yes/no alternative.

This standard is far stricter than the prohibition of stray marks on the ballot that was suggested in the previous section. It can be imposed in such a strict way that it becomes an effective tool for conducting a very crooked election!

Consider a political machine or other entrenched group desiring to preserve its power in the face of significant objections from the electorate. One way to do this is to craft voting laws in such a way that election judges have significant discretion as to which marks are acceptable as votes and which can be disregarded or used to disqualify an entire ballot.

Of course, if the two opposing judges are equally able to disqualify ballots, this poses little threat, but if the machine can control who is hired as an election judge, a natural thing to do is to hire carefully trained judges to work on behalf of the machine's party, while selecting relatively inexperienced and untrained judges as representatives of the opposition. Of course, if the opposition has the resources, they may provide training to their judges, but in the traditional machine-run metropolitan area, this has been a difficult venture.

A classical approach to enabling this kind of election manipulation has been to enact complex laws (or administrative rules) governing the acceptable forms of marks. For example, imagine a marking rule that specified that the mark shall be in the form of an X made of straight lines connecting opposite corners of the box beside the candidates name, with no part of the X protruding outside the box -- such a protrusion being considered a stray mark). A careful draftsman with a good eye may be able to make such a mark, but most voters will only approximate it. Even so, fair-minded judges are likely to ignore the fine details and accept minor deviations from this standard until they learn how strict the machine's representatives are about the slightest defects in marks for opposition candidates. By that time, a sufficient number of votes may well have been counted to determine the election!

The classical symptom of such manipulation is an unusually high percentage of votes (or ballots) being excluded for improper marking. The 1910 Encyclopedea Brittanica article on Voting Machines mentions some elections in which such rules apparently led to the exclusion of as many as 40% of the ballots cast in some elections, with exclusions being as likely in well educated upper class precincts as they were in precincts with large numbers of poor and illiterate people!

One way to prevent such absurd criteria is to enumerate the acceptable types of marks, but in Coulehan v. White, a case before the Maryland Supreme Court cited in the Encyclopedea Brittanica article on Voting Machines, 27 different styles of X were enumerated. Requiring that election judges be prepared to classify marks into such a complex scheme almost guarantees that an entrenched machine will be able to prevale over a weak opposition by ensuring that the machine's judges are better trained than those representing the opposition.

To defend against this kind of legal attack on the machinery of the election system, we may institute a mechanism such as the following:

• If one election judge believes that a ballot contains a clear and obvious indication of intent and the opposing judge with whom that judge is paired believes that the ballot should be excluded because of an improper mark, because of an overvote, or because of an undervote, the ballot should be set aside for possible arbitration, in an envelope on the outside of which is noted which vote (or votes) were subject to dispute and which judges were in dispute. The procedural difficulty this imposes will generally discourage election judges from disqualifying large numbers of votes!

• The official canvass must indicate not only the number of votes cast for each candidate, but also the number of votes on behalf of each candidate excluded from the count because of disagreements between the election judges over whether a mark is or is not acceptable. It is natural and straightforward to include the count of overvotes and undervotes in the canvass. Reporting everything guarantees that any unfair practices during the vote count will be apparent in the final figures.

• If the margin between the two leading candidates in an election exceeds the number of disputed votes set aside on behalf of the second-place candidate, those ballots must be reexamined. In extreme cases, such a reexamination might be done by a jury in court, but it would seem prudent to do this only in extreme cases. Normally, it is reasonable to hope that the difficulty would be resolved by a different team of two election judges (representing opposing parties) or perhaps by majority vote in a team of four (no two from the same party).

Ballot and Ballot Box Transportation

When ballot boxes are sealed prior to an election at a central location, and when ballots are counted centrally after the polls close, when ballots are moved to storage awaiting a request for recount, and when ballots are moved from storage to the site of the recount, it is essential that tampering be prevented.

Open transport of ballot boxes might be possible, for example, if all ballots were moved in a bus along with a crowd of observers, but generally, the cost of such a scheme outweighs any benefit. In fact, if a crowd is allowed during transport, the turmoil of a moving crowd could create new opportunities for fraud.

• Therefore, we typically require that all transport of ballots or ballot boxes be in the custody of at least two election judges, representing opposing political parties or campaigns, and that the judges travel together, in the same vehicle, with the ballot box either in plain sight of all, for example, on the seat between them, or with the ballot box locked away where nobody may touch it, for example, in a locked trunk or locked in the rear of a van.

The requirements for ballot transfer are comparable in some ways to the requirements for transfer of evidence in a criminal case. Just as we are very concerned with the chain of custody for evidence, from the policeman who observed it on the ground to the detective who put it in a bag to the evidence storage locker where it was saved prior to the trial, and finally to the person who delivered it to the courtroom, we are equally concerned with the chain of custody for ballots.

In fact, the ballots are potential evidence in a criminal trial! In the event that there is any allegation of tampering with the election, the ballots become the central evidence about which the trial revolves, and all of the steps in ballot processing become steps in the chain of custody. This chain of custody must be documented.

• At each stage in ballot processing, a written record must be maintained indicating who did what with the ballots. Who distributed them to voters, who sealed transported the ballot box, who transported the ballot box, who counted the ballots, and who saw to the locking and unlocking of the secure ballot storage area. Each entry to this record is typically signed, witnessed and dated; where possible, between signers and witnesses, opposing parties and interest groups should be represented!

Ballot Storage

Secure ballot storage is essential, both between the time ballots are printed and the time the polling place opens, and between the time the votes are counted and the end of the recall interval. It is not enough that they be stored under lock and key, since this requires that we extend unlimited trust to all who have access to the key. Furthermore, all locks are vulnerable to lockpicks!

• Therefore, we typically require that secure ballot storage be in an area that has multiple high-quality locks, each with a different key, and we require that the keys for these locks be in the custody of different officials, preferably representing opposing factions.
• We typically require that locked entrance to the secure ballot storage area be visible to the public and in an area that is regularly patroled by security personnel.
• We typically require that locked entrance to the secure ballot storage area be clearly marked with easily visible and difficult to obscure warnings requiring that witnesses be present whenever the door is open and whenever the locks are manipulated in any way.