Evaluating Voting Technology

A Followup

Submitted to the United States Civil Rights Commission
as a followup to the January 11, 2001 hearings.
February 15, 2001

Douglas W. Jones
-- Associate Professor of Computer Science, University of Iowa
-- Chair, Iowa Board of Examiners for Voting Machines and Electronic Voting Systems

Indexed on the web at http://www.cs.uiowa.edu/~jones/voting/

An Apology

One aspect of what I wrote in my written testimony came back to make me feel a bit embarrassed during my oral presentation. I wrote (with regard to punched-card systems):
In theory, a precinct-count system comparable to those used with optical mark-sense ballots would be possible, but to my knowledge, such a system has never been marketed.
To my delight and dismay, one of my co-witnesses, John Ahmann of Election Supplies Inc, brought with him a PBC-2100 punched-card precinct-count voting system built by Election Systems and Software that does exactly what I described as being theoretically possible. It works well, and can be configured to return overvoted ballots to the voter for correction, as I strongly advocate. At least, in my written testimony, I included the all-important disclaimer, "to my knowledge."

But, why didn't I know? Punched-card ballots have been illegal in Iowa for so long that I've simply ignored the technology, treating it as a fossil that was of interest only to historians. Meanwhile, John Ahmann has been patenting improvements, improving the material selection for the T-strips that back the ballot while it is in the voting machine, improved punching stylus designs with knob handles easy for handicapped voters, and adding micro-tips that spear the piece of chad, helping prevent hanging chad problems. I still believe that the shortcomings of the punched card ballot would justify its abandonment, but if a county upgraded their punch card system to use the best available practices (replace the T-strips with new ones, replace the styluses, and never, ever, use a butterfly arrangement or continue an office onto a second page) I'd let them keep going with that system for another election cycle while they accumulate the resources and do the research and training needed to make a graceful change to a new technology.

Additional Comments

After reviewing the videotape of the CSPAN 2 broadcast of the hearing and reviewing the draft official transcript I was sent, I felt a need to say more on the following points. In these notes, citations of the form [page:line] refer to page and line numbers in the draft transcript of the hearing that was sent to me on January 30, 2001.

The question of returning undervotes to the voter is one that I believe was adequately answered in the discussion: Undervotes are normal and legitimate votes, where the voter genuinely expresses no preference. Forcing the voter to express a preference in races where they have none is an intrusion. I will return to this question, but first, I want to clearly state the history of this requirement and then deal with the privacy issue.

In a typical election, each voter is allowed only one vote. An overvote, in which a voter casts two votes, is therefore deemed illegal, and in the vote count, these votes are ignored. As lever machines displaced paper ballots from polling places, one commonly cited advantage was that the lever machines contained an interlocking mechanism to prevent overvotes. All direct-recording electronic voting machines I am aware of also contain such interlocks.

The first generation of optical mark-sense and punched-card voting systems, both central count and precinct count, did not protect against overvotes; they merely discounted them in apparently the same way that they are discounted with hand-counted paper ballots. This seems fair, but in fact, it puts voters using these new technologies at a disadvantage because there are many cases where a human inspecting a paper ballot will see a clear indication of voter intent, but where a machine will not do so! For example, people do not usually mistake printing errors or wood-chips in the ballot paper for votes, while optical mark-sense machines can make this mistake.

Today, all of the new precinct-count ballot readers I am aware of offer the ability to return overvoted ballots to the voter, thus equalling the performance we have come to expect from lever voting machines. Failure to enable this feature puts voters who use punched-card or mark-sense ballots at a disadvantage relative to those using machines that contain interlocks that prevent overvotes. Therefore, use of this feature has become mandatory in many jurisdictions.

My co-witnesses Kimball Brace and John Ahmann presented evidence showing that, when overvotes are prevented by voting machines or precinct-count mechanisms, the number of voters expressing no preference in top-of-the-ticket races falls to under two percent. This is clear evidence of the importance of this feature, and strong justification for the mandate that this feature be included in any precinct-count systems.

This conclusion is further reinforced by discussions I have had with Tom Slockett, County Auditor (Commissioner of Elections) in Johnson County Iowa. He stated to me that he expects about 0.6 percent of the of the ballots will contain overvotes; the machines he is using do not return overvotes to the voter, so if 10,000 ballots are cast in an election, 60 voters will have their votes ignored by the machines.

I want to emphasize, however, the recommendation in my original written testimony that all overvoted ballots should be hand counted whenever the number of overvotes exceeds the margin in a close election. Under appropriate counting rules for optical mark-sense ballots, this offers almost as much protection as returning overvoted ballots to the voter. I have recently learned that TrueBallot Inc., a company that has dealt primarily with trade-union elections, routinely does this; my discussions with representatives of that company confirms my suspicion that hand examination of optical mark-sense ballots can easily discern a genuine indication of intent in the majority of cases where the machine finds an overvote.

It is clear, as Commission Chair Berry pointed out, that returning overvoted ballots to the voter can easily lead to privacy violations. If a poll-worker is required to examine overvoted ballots in the presence of the voter, the voter's privacy is compromised, and if the poll worker asks a natural queston such as "Why did you vote for both Bush and Gore," the intrusion is even worse.

The best practice I have seen in this regard allows the voter to insert his or her ballot directly in a precinct count ballot box. To assure that the voter does not stuff the ballot box, it is out in the open, in clear view of the poll-workers, observers, and waiting voters, and nobody is allowed to loiter by the ballot box.

Poll-workers must be instructed never to examine a voter's ballot unless the voter requests such an examination, and they must be instructed never never to question a voter's intent! If a voter needs assistance, for example, if the precinct count ballot box returns a ballot to a confused voter, the poll-worker must not look at the ballot! Rather, the precinct worker should be given sufficient information by the status display on the ballot counter that the worker can explain the problem to the voter without looking at the ballot.

In the case of overvotes, the best precinct counters I have seen make it fairly easy for the voter to deal with the problem without asking the poll-workers for help. For example, a precinct counter with a small display screen can react to an overvote by displaying a message such as the following as it returns the ballot to the voter.

Multiple votes detected in race for Governor
If this was your intent, reinsert your ballot
while holding down the green button.
If this was not your intent, please request assistance.

If the voter presses the green button, the machine accepts the overvoted ballot, allowing a voter in a hurry or a voter making a deliberate overvote to leave. Ideally, a ballot diverter should stack overvoted ballots in a separate internal bin, so that they may be hand examined later, if the numbers warrant such examination. If the voter requests assistance, the poll-worker's primary job after explaining the meaning of the machine's message is to explain the procedures for obtaining a replacement ballot and declaring the original to be spoiled.

An interesting secondary issue has arisen in the context of this procedure in Iowa. What do the poll-workers do if a voter inserts an overvoted (or otherwise unacceptable ballot) in the precinct-count ballot box and then turns and leaves the polling place as the machine is attempting to return the ballot? The answer we have written into our administrative rules to govern such a circumstance is that the poll-workers should treat the ballot in the same way that absentee ballots are treated when they are rejected by the ballot counter.

All such ballots are set aside until all other ballots have been counted, and then two election workers, representing opposing parties and working together inspect each such ballot, transcribing all discernable indications of voter intent from the rejected ballot to a new ballot. The original and copy are given serial numbers so that, in case questions arise, the accuracy of the copy may be checked. The original of each ballot is saved with the spoiled ballots, and the copy is then inserted in the machine so that the votes may be added to the count. My suggestions for hand-checking all overvoted ballots are a natural extension of this practice!

I feel that it is important to note that the Nevada option of voting for none of the above is not the same thing as an abstention. In Nevada, as I understand it, none of the above can win an election! When this happens, if my understanding is correct, the office goes unfilled and something of a crisis situation ensues in which the very existance of the office, as an elected office, is brought into question. In contrast, when a voter abstains, it simply means that his or her vote is not considered in determining the outcome.

In thinking about this issue, I suspect that it would not be a good idea to to force voters to explicitly abstain from every race in which they have no wish to express a preference. I suspect that this would annoy voters who were in a hurry, forcing those who only want to vote in a few races to wade through a long ballot in order to abstain from race after race in which they have no interest. As with questions about the butterfly ballot, this is a human factors issue that is subject to empirical testing. Someone should do the experiment in a simulated polling place setting and see how potential voters respond.

After reviewing the video tape and draft transcript of my tesitmony, I am not satisfied that I offered a sufficiently clear answer to this question.

As I said, the current Federal Election Commission standards for electronic voting systems are weak and they are not mandatory. My hope that the FEC standards be strengthened can be divided into two components, one addressing weakness, and one addressing mandatory standards.

First, we can significantly strengthen the standards while retaining their voluntary character. For example, I believe that the standards should be expanded to cover such things as data formats for electronic reporting of ballots and canvass subtotals, the standards should require reporting of over and undervotes, and and they should eliminate most exemptions for third-party industry-standard software components.

Such changes will have a great impact even if the standards remain entirely voluntary, since many vendors see conformance to the standards as a marketing tool. If even a few states write these extensions of the standards into law, the effect on the machines offered for sale in all 50 states will be significant.

Second, I hope that some aspects of the standards will become mandatory; this could happen as a result of the Supreme Court decisions surrounding the Florida recounts, or it could happen as a result of legislation. Even if the standards remain unchanged, this will have a significant effect because it will bring those states that have not adopted the current standards into line, and it could force upgrades to older systems that are currently covered by grandfather clauses in the state laws that currently mandate conformance to FEC standards.

These two approaches to strengthening the FEC standards can be pursued independently. My understanding of the current political situation suggests that a strong federal legislative mandate is unlikely, and it seems that the majority in the Supreme Court has attempted to limit the impact of their decision. Because of this, I feel that the most appropriate short-term path toward election reform lies in strengthening the current system of voluntary FEC standards, while we should look, in the long term, toward a more effective mandate.

We have discussed this possibility in a recent meeting of the Iowa Board of Examiners for Voting Machines and Electronic Voting Systems. In Iowa, there are two relevant laws: One law states that overvotes do not count, while the other states that a write-in vote for a candidate whose name already occurs on the ballot is to be ignored. There are several ways to combine the effects of these laws!

If we discount the overvote first, we have no need to look at the write-in vote. This ignores the voter's obvious intent! If we discount the write-in vote first, we have converted an overvote into a normal vote, honoring the voter's eccentric but clear expression of intent.

Under Iowa law, as I understand it, the voter's intent decides in favor of the second alternative. During the hand processing of write-in votes, we normally require that write-in votes for names that are already on the ballot be ignored. If, however, there is an overvote for the same name, we count the write-in vote; in effect, this corrects for the automatic discounting of the overvote that was done by the machine.

First, I would like to note that I have never seen evidence that any punched-card or optical mark-sense voting system in use today meets the naive interpretation of the accuracy requirements of the current Federal Election Commission Standards for P&M and DRE Systems (1990). Section 3.2.5.2.1 specifies an accuracy of 1 in 1,000,000 for punched card and optical mark-sense machines. Unfortunately, the standard uses the phrase "a valid punch or mark" in a manner that allows a marvelous degree of flexibility! In effect, we are almost given the freedom to declare that all marks the machine counted were valid, and all marks it did not count were invalid.

In my experience, mark-sense ballot readers offer excellent accuracy, although far from the 1 in 1,000,000 required by the FEC standards. In my home county, Johnson County Iowa, we currently use 16-year-old Optech II precinct-count mark-sense machines made by Election Systems and Software. It is notable that these are made by the same company that makes the PBC-2100 precinct-count punched-card system demonstrated at the hearing. Our local county auditor, Tom Slockett, has told me that, in a typical machine recount in Johnson County, the results are rarely off by more than 1 in 10,000 from the original count. I consider this to be in substantial agreement with the 1 in 6000 error rate I infer from Witness Gloger's figures for the punch card voting system used in Dade County.

Witness Gloger's figures for the optical mark-sense system used in Seminole County, Florida indicate an error of 670 in 130,000. This comes to about 1 in 200, a disturbingly high error rate. I can only guess at the cause, but there seem to be only a few alternatives. First, the machines could be extremely bad. I have seen central-count optical-scan vote counting machinery perform this badly during certification testing in Iowa; when this happened, we refused to certify the machines! I have not tested a precinct-count machine that approached this error rate, so I am left wondering about procedural and administrative errors.

Clearly, poor maintenance, primarily dirt accumulation, could account for such errors, but this is not the fault of the machine; this is the fault of the county elections office. Similarly, if there were simple tabulation errors, for example, the failure to include counts from some machines in the totals, or the failure to note that some machines had been reset in mid-count, this could account for the reported error rate. But again, these problems are not the fault of the machines; they are evidence of significant administrative failure.

This problem is a serious one, and it raises serious questions about how Florida certifies voting systems for use in the state! The Federal Election System Standards for P&M and DRE Systems (1990) require that precinct-count systems be able to operate for 16 hours under battery power (section 3.2.1.4), and that no data will be lost due to power interruptions or similar events (section 2.3.3). If Witness Gloger's statements accurately describe what happened, it would appear that the machines in question did not conform to these standards. Does Florida require conformance? Does Florida have an effective voting machine certification process that will catch such shortcomings?

Independently of this, I should note that strict ballot accounting procedures I recommended in my written testimony would have caught this problem immediately! If each precinct maintains records of the number of ballots issued to voters and the number of ballots spoiled, and if each machine counts overvotes, undervotes and legal votes, simple reconciliation procedures will catch such errors. The total machine count plus the spoiled ballot count should equal the total number of ballots issued, and the total of undervotes, overvotes, and legitimate votes for one or another candidate should equal the ballot count. I know of no jurisdictions that systematically apply such simple checks today, and I would strongly urge the universal adoption of such checking!

I am gratified to note that Witness Ahmann also urged the adoption of similar accounting rules [323:18 - 324:6].

In any case, the vulnerability to the problems Witness Gloger mentioned is not limited to optical mark-sense systems, but is, in fact, a potential problem with every precinct-count system.

I agree with Witness Gloger that the current generation of precinct-count machines makes county-wide recounts difficult. This does not depend on the fact that the machines are punched-card or mark-sense, but rather, it depends on the use of precinct-count machines to carry out the recount at the central counting center. Central-count machines, no matter what kind of ballot they are designed to count, include automatic card or page feeding mechanisms that make it easy to automatically process ballots in bulk. Use of precinct-count machines to do a recount requires that clerical staff feed each ballot through the machine by hand, an annoying and labor intensive process!

Several precinct-count optical mark-sense ballot vendors today are starting to offer central-count systems for the same ballot format, motivated by the problems counties face with absentee ballot processing. This trend offers hope of fater recounts for such systems.

In my experience, gained largely from testing precinct-count machines for certification purposes, I can hand feed about one ballot per second, with interruptions of a few seconds each time the machine encounters an unreadable ballot. Most of today's precinct-count machines cannot count the ballots for more than one precinct, so before counting one precinct's ballots, the machine must be reprogrammed and reset, usually a matter of changing a programming pack and pressing a button, but still an interruption in the counting process. After counting one precinct worth of ballots, the machine must be shut down to force a printout of that precinct's totals. Printing the totals on a typical modern precinct counter's cash-register style printer takes about as long as it does to force feed it with one precinct's worth of ballots, and resetting the machine for the next precinct takes as long again. Sadly none of this complexity is necessary!

I take the initials "L & A" to refer to "logic and accuracy" tests on voting systems. Witness Gloger's comparison should not be interpreted as comparison of punched-card versus optical mark-sense systems; it should be interpreted as a comparison of central-count systems with precinct-count systems!

Exhaustive logic and accuracy testing of a central-count system is easy to manage. There is only one mechanism to be tested, and therefore, it is easy to justify a complete pre- and post-election test for the entire mechanism. This is true no matter what kind of central-count system is being tested.

In contrast, with precinct-count systems, a jurisdiction may have hundreds of machines to test. If we demand the same standard of testing for precinct-count systems, this will multiply the cost of testing several hundredfold, and few jurisdictions will be able to afford this.

Therefore, with precinct-count systems, whether they use mark-sense or punched-card technology, we are forced to rely on a combination of three things. First, it is common to do complete tests on some of the machines before and after each election. This should be viewed as a form of statistical quality control. Second, every machine should be subject to procedurally simple pre- and post-election tests; these should be simple enough that they take only a minute or so per machine, but with good design for testability, they can accomplish quite a bit. Finally, we need auditing, ballot accounting and canvassing procedures that make it extremely unlikely that machine errors will go unnoticed, and when an error is suspected, we need to allow an immediate and automatic partial recount as part of the canvassing procedure.

There are a host of problems with electronic transmission of vote totals or electronic ballot images that are not properly addressed by current Federal Election Commission standards! The memory packs of modern precinct-count and direct-recording-electronic voting systems are the size of a credit card, so even with strict supervision by members of opposing parties, substitution of one card for another should be a simple matter for anyone experienced with sleight of hand. Use of public telecommunication networks, whether radio, telephone or Internet, opens the door to hackers.

During the voting system examinations I have been involved in, I have made a routine habit of questioning vendor's representatives about the security of their electronic vote records, and I have been uniformly disappointed in the answers I have received. In many cases, the vendors are unwilling to disclose sufficient information to assure me that their methods are secure. The oft-repeated excuse is that revealing such information would compromise the security of their system. As a general rule, well designed secure systems are not compromised by disclosures of the mechanism!

In several cases, after extended questioning, I have concluded that the system being used was, indeed, relatively secure, but this was an unintended consequence of features included in the design for other reasons! In other cases, after extended questioning, I have learned that the vendor's system, while carefully designed to ensure security, had major flaws that rendered is insecure.

Because of this, we have not moved to permit the use of hand carried or machine transmitted electronic records in computing official election canvasses in Iowa. Instead, we require that each voting machine or precinct-count system produce a paper printout of its totals, and we require this to be signed by the poll-workers and hand delivered to the county canvassing board. Any electronically communicated results are only for the benefit of the press as they rush to announce the vote totals.

Witness Gloger's stated belief is incorrect. The Optech Eagle, also made by Election Systems and Software, does exactly the same thing as the PBC-2100 he demonstrated. In fact, Section 3.2.5.1.1 of the Federal Election Commission Standards for P&M and DRE systems (1990) requires that all purpose-made ballot readers either separate write-in ballots from others or mark them for easy separation, and I have seen none that use the marking approach.

This is an important question. Today, with most voting technologies, a large fraction of handicapped voters require assistance to mark or punch their ballot, or to pull a lever or to touch the screen of a voting machine. Such handicapped voters therefore have no right to a secret ballot. They may, of course, select the person they take into the voting booth for help, but this requires that they find someone they trust to mark the ballot as they intend and to keep their vote secret. As I have said, it is not desirable to rely on trust in the conduct of elections!

Today's handicapped accessible voting machines or voting booths are basically wheelchair accessible. They are reasonable for those who have significant use of their arms, but they offer little or no help to those with vision problems or poor motor control, and, as Witness Dickson has noted, the majority of those classified as handicapped today suffer from some combination of minor to moderate motor disability with minor to moderate vision limitation. Today's handicapped accessible voting machines, for example, do little to aid an elderly voter with tunnel vision and a tremor. If anything, we place roadblocks in the way of such voters by setting time limits on how long they may take to vote, and it may take many minutes of deliberate effort for such a voter to correctly mark a ballot.

Recently, I have seen one handicapped accessible direct-recording electronic voting machine that incorporated speech synthesis and speech recognition technology, so it could talk a voter through the voting process, hands free. This is a marvelous application of modern technology, but I wonder if it is overkill.

I wonder if there are equally effective low-tech solutions that would work with optical mark-sense paper ballots. Consider, for example, making transparent overlays for the ballot with holes punched over each valid voting position. This would prevent a person with a tremor from accidentally scribbling on the ballot. Emboss the office titles and candidate names on the overlay in Braille, and a blind voter could feel for the punched holes and mark through them. Provide a ruler to help the person with tunnel vision scan from name to marking position, and that voter would be satisfied.




Douglas W. Jones