Testimony before the United States Civil Rights Commission
Tallahassee, Florida, January 11, 2001.
Douglas W. Jones
-- Associate Professor of Computer Science, University of Iowa
-- Chair, Iowa Board of Examiners for Voting Machines and Electronic Voting Systems
Indexed on the web at http://www.cs.uiowa.edu/~jones/voting/
I have been a member of the Iowa Board of Examiners for Voting Machines and Electronic Voting Systems for the past six years, and in the fall of 1999, I was elected chair. In these years, I have examined voting systems made by Microvote, Election Systems and Software, Global Election Systems, Fidlar Doubleday, and others. Old timers tell me that, not too long ago, there were only two vendors of lever voting machines, and the only other choice was paper ballots; this time is long past! Today, in Iowa, we have 6 approved voting systems, and I know there are vendors we have not heard from.
In short, we are in the midst of a revolution in the way we vote. This revolution started in the 1960's with the introduction of punched card voting, and not long after that, optical mark-sense voting. In the last 10 years, the rate of change has increased. This revolution offers wonderful opportunities, but the technology we use has left our laws and regulatory structures far behind, and this poses real perils for our democracy.
In the next few minutes, I would like to briefly outline the technologies currently available for voting, along with the problems these pose, but first, I would like to address some broader issues.
It is extremely important to emphasize that voting technology cannot be evaluated in isolation! Each voting technology, whether it rests on hand counted paper ballots or on modern electronics, is part of a system. Some of the system components may be mechanical or electronic, but others are legal and administrative, and none of these can be ignored when evaluating the technology.
Thus, whenever hand vote counting plays any role, we must examine the laws and administrative rules governing the count. Similarly, when any mechanical processes are involved, we must ask how the mechanisms are prepared, maintained and checked for proper operation, and when computers are involved, we must ask about the rules governing their programming.
I am particularly concerned by the claim repeatedly echoed in the media last month that a machine count is inherently unbiased and should not be subject to dispute. Machines can be unbiased and accurate, but we can only trust our machines as far as we trust those who maintain and program them. There are two primary ways to ensure that a machine count is trustworthy. One is to routinely hand count some fraction of the ballots, as a matter of quality control, and the other is to require complete public disclosure of the mechanism or software used in the count.
The suggestion that an honest electoral system must be based on trust is a dangerous one! We must not trust any particular participant, mechanism or computer program; in fact, we must expect every participant, the maintainer of every mechanism, and the designer of every computer program to be a partisan. The way we assure that the system itself is trustworthy is to construct an adversary system, where each step in the process is carried out not only in public but in the presence of and under the supervision of representatives of opposing parties.
Today, each of the 50 states acts independently in selecting the technology or technologies to be used in voting. Typically, the Secretary of State serves as the state commissioner of elections, enforcing state laws and promulgating administrative rules governing the use of voting technology, and determining what particular systems may be used in the state. In many states, there are appointed boards of examiners for voting machines, charged with the job of approving voting machines for sale in the state and advising the Secretary of State about their regulation. I chair such a board.
Each county typically has a county commissioner of elections, sometimes serving in some other office as well, such as county auditor. The counties are typically responsible for the purchase and operation of voting systems, selected from among those permitted by the state. Generally, because county budgets are tight and frequently dominated by serious human services issues, counties have been reluctant to buy new voting systems, and state governments have been willing to tolerate this even when the systems being used have known inadequacies.
The direct Federal role in elections has been severely limited, but the Federal Election Commission has promulgated standards, and a growing number of states have enacted into law the Federal Election Commission's January 1990 standards document, a document that governs essentially all voting systems other than paper ballots and mechanical lever machines. Unfortunately, these standards are far from perfect, and the number of states that have not yet required conformance to these standards is embarrassing.
There are five broad classes of voting technology in use today, paper ballots, lever voting machines, punched card ballots, optical mark-sense ballots, and direct-recording electronic voting machines. Each of these has its strong points, and each has significant weaknesses.
In summary, the great strength of paper ballots, including punched card and optical mark-sense ballots, is that they offer a physical record of each vote cast, and therefore, if there is any question about the trustworthiness of the original count, a recount is possible. This is not true of lever voting machines or direct-recording voting machines! With these, even if they purport to keep a record of each voter's ballot, this record is only indirect evidence of some voter's expressed preference; it is only as trustworthy as the mechanism used to transcribe the vote.
The great weakness of paper ballots, including punched card and optical mark-sense ballots, is that they are subject to interpretation. Most voters are very conscientious about how they mark their ballots, but even so, some marks or punches are marginal. The rules governing the interpretation of these marginal marks have been manipulated for partisan advantage for at least a century, yet there are straightforward reforms that would make such manipulation extremely difficult.
Voting machines, both the old lever machines and modern direct-recording electronic voting machines, offer an immediate vote total as the polls are closed and they eliminate the need for, and in most cases, even the possibility of a recount.
The most obvious problem with voting machines is their sheer complexity. Hundreds of springs and levers and thousands of gears fill the mechanism of mechanical lever machines, and the most modern of direct-recording electronic voting machines contain complete personal computer systems with large bodies of complex software. How can we ensure ourselves that such systems operate correctly? Typically, we must simply trust the designers and maintainers of the machines, and it is dangerous to rely on trust when conducting elections.
I believe that no voting technology available today is good enough to be adopted as a national standard, and I believe that we benefit from a technologically diverse marketplace offering many different voting technologies. I believe, therefore, that the current press for uniformity should be directed toward uniform performance and accountability standards, and not on the creation of a single standard voting system.
In my written comments, I have offered a more detailed examination of each of the available voting technologies, along with detailed suggestions for reforms that I feel are needed. I will gladly answer any questions you have about these technologies, their weaknesses and the reforms I feel are required.
I will begin my survey of voting technologies with a technology we tend to take for granted today, the paper ballot. We may think of paper ballots as an antiquated low-tech voting system, but the paper ballot system we use today was far from obvious when it was first introduced in Australia in 1858, and it took years before it was widely adopted in this country. If properly used, the Australian paper ballot system of voting sets a standard for fair and honest elections that is not easy to match with more recent voting technologies.Paper ballots may be transported to a counting center, or they may be counted at the precinct immediately after the polls close. An honest count is ensured by having each ballot inspected by two election workers, representing opposing parties, with observers from opposing parties allowed to watch over their shoulders. If there is any doubt about the count, it may be resolved by a recount.
The 1910 Encyclopedia Britannica (11th Edition) entry for voting machines enumerates serious problems with the Australian secret ballot. There are two chief problems. First, ballot tampering during vote counting is a real problem. For example, a bit of pencil lead carefully parked under a fingernail is all it takes for an election worker to surreptitiously add marks to ballots. The second major problem is a result of election regulations that set unreasonable standards governing the interpretation of marks on the ballot; reports from a century ago indicate that in some elections, up to 40% of the ballots cast may have been declared invalid!
While laws and administrative rules dictating the acceptable forms of marking on a ballot may appear to ensure uniformity, partisan election workers and legislators have long known how to craft these rules so as to allow knowledgeable election workers to discard a large fraction of the votes they dislike. This is a major voting rights abuse! The simplest defense against this abuse is the simple requirement that any ballot containing a clear indication of the voter's intent be counted!
Elaborating on this simple rule leads directly to the requirement that the official canvass should include counts not only of the number of votes for each candidate, but also counts of the disputed votes where one member of a vote counting team held that the vote was for one candidate while the opposing member held that the vote should be excluded for one reason or another. I urge that such a requirement be enacted into law, and that it apply to all hand counting of votes, no matter what ballot format is used!
Such a publication requirement makes it very difficult to hide bias in the vote count, but we can go farther than this! If the number of disputed votes on behalf of a runner-up in the election would be sufficient to give that candidate a lead over the un-disputed votes for the winning candidate, all ballots containing disputed votes should automatically be reexamined, and this examination should be done by vote counters other than those who conducted the initial examination. This, of course, requires that disputed ballots must be set aside during the initial count, with documentation of what votes were disputed by which vote counters. In extreme cases, if an agreement cannot be reached, it may even make sense to require that the disputed ballots be examined in court by a jury composed of eligible voters after appropriate instruction by a judge.
The 1910 Encyclopedia Britannica (11th Edition) entry for voting machines briefly describes the Meyers Ballot Machine, first used in New York in 1892. This machine had most of the characteristics of the lever machines still in use in many jurisdictions, and by 1910, the U.S. Standard voting machine, an improvement on this scheme, was in widespread use. There have been many improvements since then; Shoup, for example, made major improvements in the 1930's, but the essential principles of the lever machines that survive today are basically the same as those of a century ago.Lever machines count the votes as they are cast! They retain no physical ballot, but simply accumulate votes on odometer mechanisms inside the case.
Lever machines completely eliminate the problems of ballot interpretation that accompany paper ballots, they contain interlocks to prevent overvotes, and they eliminate the possibility of the kind of ballot tampering that characterizes the more dishonest counts of paper ballots. They offer these benefits at a significant cost! The counters in lever machines are immensely complex, with thousands of moving parts. Exhaustive tests of these counters are difficult and therefore rare, and the vote counts obtained from these machines are only as trustworthy as the technicians who maintain them.
Furthermore, because there are no physical ballots, if there is any suspicion of malfunction or tampering, there is nothing to recount. When people speak of a recount with lever machines, they are speaking of repeating the tabulation of the canvass of the election, starting with the totals in the machines. This can correct errors in tabulation and transcription, but it cannot verify that the machines did, in fact operate correctly.
It is worth noting that, in the 1970's, lever machines were designed that had auxiliary card punches built into them, so that a physical ballot was produced for each vote, but I am unaware of any jurisdiction that has used these machines. Furthermore, this new mechanism added to the complexity of the machine, and the voter never saw the ballot produced; as a result, this ballot is no more reliable or trustworthy as a measure of the voter's intent than the additional mechanism needed to produce it.
Several years ago, George Mather of the University of Iowa did some research on the effect of voting technology on voter participation. He found that voters using paper ballots were significantly more likely to participate in bottom-of-the-ticket races than voters who used lever voting machines. This suggests that much of the public confidence in classical lever machines is seriously misplaced! Mather has stated that lever voting machines should be phased out and I agree with him.
Punched cards were developed for data processing back in the 1890's, but they were not used as ballots until 1964. The first form used, still widely used today, was the Votomatic ballot, originally developed by IBM, based on pre-scored punched cards, with a voting machine that allows the voter to indicate votes by punching the card with a stylus. The Votomatic voting machine is not so much a machine as it is an alignment fixture and ballot label holder. The less widespread Datavote punched card system uses a nonstandard punched card format, allowing long cards that include space on the card itself for office descriptions and candidate names.Punched card ballots are typically counted at a central counting center using an industry standard punched card reader attached to a computer system. As such, counting is deferred until the polls are closed. Because the punched card is a physical ballot, any questions about the correctness or accuracy of the vote counting software can be resolved by a hand recount of the ballots. In theory, a precinct-count system comparable to those used with optical mark-sense ballots would be possible, but to my knowledge, such a system has never been marketed.
I recommend that punched card voting should be abandoned immediately. The problems that plague the Votomatic ballot are not news! These problems have been widely known for decades, and I have little sympathy for counties that had no plans in place a decade ago for migration to a better voting technology.
As I understand the history, we banned punched card ballots in Iowa in time for the 1984 general election, for all but absentee voting. In August 1988, the National Bureau of Standards published Accuracy, Integrity, and Security in Computerized Vote-Tallying, a report by Roy G. Saltman recommending an immediate end to the use of pre-scored (Votomatic) punched card ballots (see NBS SPEC PUB 500-158). In the fall of the same year, the Computer Professionals for Social Responsibility published a piece entitled Computerized Vote Counting: How Safe? by Bob Wilcox and Erik Nilsson; this paper also called for the elimination of the Votomatic ballot. (This is available on the web at http://www.cpsr.org/publications/newsletters/old/1980s/Fall1988.txt.)
People have a fairly easy time interpreting marks made with a pencil or pen on a paper ballot; most of us have been making and interpreting marks on paper since early childhood! In contrast, when punched card ballots are subject to a hand count, we are forced to deal with an unfamiliar medium with arcane problems such as hanging or pregnant chad. This makes it very difficult to rely on criteria such as the intent of the voter, forcing us to rely on the kinds of complex classification schemes that, a century ago, were the basis of significant abuses of the Australian paper ballot. Things are even worse when the criteria used are set independently by each jurisdiction and not set by law or state-wide administrative rules!
In fact, appropriate criteria for judging the admissibility of votes indicated by bulges, dimples, and punctures in a Votomatic ballot can be determined objectively! The force required and the conditions leading to each of these outcomes in a Votomatic voting machine can be measured. Once this is done, if we are in agreement, for example, that both a trapdoor punch and a clean punch count as votes, then we ought to accept any result that requires greater force than the force required for these, particularly if the conditions required for these outcomes are abnormal.
I have done some experiments along these lines, using several old pre-scored punched card ballots in my collection. My results must be taken with a grain of salt because I have no access to a Votomatic voting machines nor accurate force measuring equipment, but I found that the force required to create "trapdoor" chad is less than the force required to cleanly punch a prescored ballot, and I found that clean punching with a stylus requires a backing block that causes the chad to bend over the tip of the stylus. If the backing block is sufficiently worn that it does not bend the chad, the result will be an easy punch and a trapdoor.
I found that the force required to bend the chad is greater than that required to break two corners loose from the ballot to create a trapdoor, and as a result, I strongly suspect that bent pieces of chad found blocking holes in the ballot actually began as a trapdoors that were forced closed in subsequent ballot handling. The force required to create a radially symmetrical dimple is even greater than that required to make a simple bend, and the force required to puncture the cardstock without tearing the chad free is even greater yet. I cannot create such a dimple or puncture without a fairly firm obstruction behind the ballot, and this led me to suggest to a reporter from the Fort Lauderdale Sun Sentinel that he should investigate the maintenance and pre-election testing that were used. The results of this investigation, published by the Sun Sentinel on December 1, appear to confirm my suspicions.
I am seriously concerned that I have heard no reports in the press of any similar experiments during the protracted battle over the recounts. Every press report I have seen suggests that the criteria used to determine the admissibility of dimples, bulges and other oddly punched chad were either based on intuition, on precedent, or on seriously flawed arguments about the ability of voters to meaningfully inspect their ballots after removing them from the Votomatic voting machines.
One of the worst features of the Votomatic ballot, aside from the fundamental problems of hanging chad, is that the names of the candidates and offices are not printed on the ballot itself. When the ballot is in the voting machine, the voter cannot easily inspect it to see if it is punched properly, and once the ballot is removed, while the voter can pick off bits of hanging chad, it is impossible to tell if the resulting holes are the holes the voter intended. Thus, it is not really meaningful to ask voters to verify that their ballots are punched in a way that reflects their intent before depositing the card in the ballot box.
For at least 20 years, a competing punched card technology has been available, using plain cards instead of pre-scored cards, and using a spring loaded punch instead of a stylus. This eliminates dangling chad and most of the interpretation problems posed by the Votomatic ballot, but there is little reason to adopt this system because the primary appeal of the punched card ballot was that it was compatible with standard punched card technology as used in the computer industry. Today, the computer industry has abandoned punched cards, and in fact, the only widespread use of punched card technology today is the Votomatic ballot!
Optical mark sensing technology was originally perfected at the University of Iowa in 1955 for machine scoring of educational tests, notably the ACT college entrance exam. The original mark-sense readers were large and cumbersome machines, found only in the service bureaus associated with the big educational testing companies, but by the late 1960's, optical mark sensing technology was far more widely available, being offered, for example, as an optional add-on to the relatively low cost punched card readers made by many vendors.Mark-sense ballots are physical ballots, like punched cards, but because they rely on marks on paper, like conventional paper ballots, hand recounts do not require knowledge of arcane things such as dangling chad. Mark-sense ballots may be used in a central-count setting, with a single high speed reader serving an entire county, or they may be used in a precinct count system, with mark-sense readers mounted directly on each ballot box. In the latter configuration, many vendors offer machines that count the votes promptly, while the voter is present, thus allowing improperly marked ballots to be returned to the voter for correction.
Mark-sense readers are not perfect! Early readers and many currently on the market were very picky about the type of ink or pencil used. The requirement many of us remember from standardized tests, "use only number-two soft lead pencil," is still very common. It is extremely difficult to prevent a voter from using his or her own pen or pencil in the voting booth, and it is even harder to enforce marking requirements for absentee ballots.
Because of this, I recommend that we should routinely monitor the performance of ballot counting machines and their software by conducting hand recounts of randomly selected sample precincts, perhaps one per county. This would also ensure that, should there be a request for a general recount, the county election officials and a reasonable number of election workers will be experienced in the conduct of hand recounts.
Fortunately, the new generation of mark-sense voting systems tend to be based on fax machine scanners or color image scanners; unlike the older systems, these can read marks made with almost anything. I have not found all vendor claims in this area to be trustworthy, but I have found that, overall, the new generation of mark-sense ballot readers is far better than previous generations; many machines currently on the market can easily read marks made with every pen and pencil I have been able to find in my house while rejecting all but the most smudged erasures.
Whatever optical mark sensing technology is used, it will occasionally find smudges or defects in the ballot paper that are darker than legitimate marks. An attempt to set the reader's threshold to prevent it from counting smudges will therefore cause it to undercount legitimate votes, while setting the threshold to prevent an undercount will cause the reader to count some smudges or paper defects as votes!
Because an undervote is legitimate in any race, and because it is both common and responsible for a voter to abstain in bottom-of-the-ticket races where he or she knows none of the candidates, mark sensing thresholds should be set low so that the only undervotes reported are deliberate undervotes, while mark sensing errors in votes on important top-of-the ticket races are very likely to be detected by the machine as overvotes. This requirement should be imposed on all new mark-sense readers. Furthermore, when possible, voting machinery should return all overvoted ballots to the voter for correction. This is not possible with a central-count system; we currently require that all new precinct-count mark-sense machines sold in Iowa adhere to this rule.
For central-count mark-sense systems, machine detected overvotes that were not corrected by the voter should be subject to a hand count if their number exceeds the margin between the leading candidates. In Iowa, we sometimes approximate this in our administrative rules for some of the newer mark-sense systems, and I believe that this rule should be applied universally. This requires that central count mark-sense readers must be capable of sorting overvoted ballots out of the stream of ballots passing through the reader.
It is noteworthy that the total of votes, disputed votes, overvotes and undervotes counted for any particular race should exactly equal the number of ballots counted in the election. This is true whether the count is performed at the precinct or at central counting centers, and it should be true of totals and subtotals at every level in the canvass. Therefore at each level in the reporting process leading to the official canvass, in addition to reporting the number of votes for each candidate, the number of overvotes, undervotes and disputed votes should be reported, and the sum of these must equal the total number of ballots counted in all precincts covered by this report. This simple rule can be used to catch a large fraction of the clerical errors that occur in the tallying of the official canvass.
Direct-recording electronic voting machines are based on the microprocessor technology that emerged in the mid 1970's; the earliest direct-recording electronic machines, such as those made by Shoup and Microvote, did a fairly good job of imitating the look and feel of the classical lever machines. Emulating lever machines may not be a good idea, as George Mather demonstrated in his work on the impact of voting technology on voter participation. More modern direct-recording machines such as those made by Global Election Systems and Fidlar Doubleday take a different approach, using large color touch screens and an interface model borrowed from the personal computer domain.I have seen no independent research on the impact of this new user interface on voter participation, but my gut reaction is that it ought to be favorable. I would strongly urge that the Federal government should routinely conduct experiments on voter response to every new user interface that reaches the market. Had such experiments been routinely conducted over the past three decades, I would hope that they would have uncovered the risks of such user interface innovations as the butterfly ballot used in South Florida and the two-page presidential ballot used in Jacksonville. A general election is the wrong venue for conducting such experiments!
Direct-recording voting machines do not use physical ballots! As with the older lever machines, the vote is processed by the machine's mechanism as it is cast. Some direct-recording machines count votes immediately as the voter leaves the machine, while others record a ballot image so that vote totals can be computed when the polls close, or even later at a central counting site.
Direct-recording electronic voting machines are distributed as parts of larger systems that provide for absentee voting using some form of physical ballot, ballot preparation and formatting software for use prior to an election, and vote tabulating software. Unfortunately, the current Federal Election Commission standards cover only the voting machines themselves, ignoring major aspects of the larger system in which the voting machine rests. This oversight must be corrected.
As with lever machines, one of the fundamental questions about direct recording electronic machines is, who must you trust. With a lever machine, anyone with a moderate degree of mechanical intuition can probably figure out the mechanism enough to be able to test it or tamper with it. With direct-recording electronic machines, the pool of people we must trust is far smaller because most of the mechanism consists of software that runs on the microprocessor inside the machine. Today, all of the machines on the market use proprietary software, and all data inside the machines is recorded in proprietary formats! Very few people are in a position to inspect or verify the correct operation of the mechanism, but equally few are in a position where they could tamper with it.
In effect, with direct-recording electronic voting machines, the integrity of the voting system is in the hands of a very small number of people, and there is no sure way to check the reliability of the count! Even if a direct-recording voting machine offers the option of printing out a complete record of the votes cast on that machine, the record cannot be treated as direct evidence of the votes in the same way that paper ballots are treated. Rather, this record is only as trustworthy as the software that transcribed the vote from the push buttons or touch screen used by the voter.
Current Federal Election System standards ask that all proprietary software within a voting machine be subject to audit by an independent third-party testing authority. Today, this means that someone employed by Wyle Labs examines the code, but this examination has a large loophole. All "industry standard" components are exempt from this inspection. In early direct-recording electronic voting machines, there was very little code exempted by this rule, but most of the more recent machines are essentially personal computers, complete with general purpose operating systems, database management systems, other complex but industry standard software, all of it exempt.
I strongly urge that we should require either public disclosure or independent third-party inspection of all software involved in ballot presentation and vote tablulation, whether that software runs on the voting machine or on auxiliary systems. The only exempt software should be software proven to be incapable of having any effect on the outcome of an election. This requirement would not place an undue burden on the manufacturers; there is public-domain software widely available today for performing essentially all of the functions currently performed by exempt software on today's machines.
I strongly urge that the Federal government should formulate standard data formats for electronic representation of ballot images and of intermediate totals obtained during the ballot count. These should apply to all electronic storage or transmission of votes, no matter what kind of voting machine is used. This would allow integration of machines from different vendors and it would allow genuinely independent vote counts, using software from a different vendor when a machine recount is conducted.
The survey of voting technology given above contains many recommendations, each presented in response to the technological problem that gives rise to it. Here, I have sorted these recommendations by their place in the voting system.
The following recommendations require changes in the role of the Federal government in the election process.
The following recommendations should be incorporated into the Federal Election Commission Voting Machine Standards, but Federal rule making is a slow process, and I would urge the individual states to consider writing these rules into law while we wait.
The following recommendations cover practices that, so far as I am aware today, are not covered by Federal standards; as such, I would urge the individual states to consider writing the following rules into law. It is possible, however, that the civil rights arguments that form the basis of the recent Supreme Court decision about the November election may lead directly to a Federal role in enforcing such rules.
The following recommendations also cover practices that, so far as I am aware today, are not covered by Federal standards; again, I urge the individual states to consider writing these rules into law.
Notes added after the hearing
The above material was presented to the commission in conjunction with my oral testimony in the Expert Panel on Voting Technology, 3:15-5:00 PM Jan 11, in Tallahassee. I read an abridgement of the first part of this material as my opening statement, 53 to 60 minutes into the panel discussion. The hearing was covered live on CSPAN 2 (without interruption) and CNN (with breaks for their world news update), and if previous patterns are followed) a transcript should appear on the commission's web site.
Additional notes I added after the hearing have been incorporated into my written followup, indexed separately.