10 ms·

Paper and pencils please.

jcrawfordor 7y ago
The discussion over paper vs. electronic ballots tends to miss many of the largest issues in election security. DHS is correct in pointing out that we need a focus on the larger landscape of election support infrastructure. Notably, electronic pollbooks are a very important part of the voting system which cannot readily be replaced with a non-digital solution. Simply switching to paper ballots reduces the problem, but does not by any means eliminate it. Calls for paper ballots also tend to get muddled up in the realities of how ballots are counted. When paper ballots are used, they are virtually always still counted by computer using an OMR. A precinct tabulating solution, which is widely used in the US right now, simply moves the OMR from the central election office out into the polling place, and is broadly equivalent from a security perspective to what most people would call a "pure paper" solution except that the environmental exposure of the OMRs is higher because of their presence in field voting locations. However, security measures used to protect centralized OMR in jurisdictions without precinct tabulators are not necessarily any better than OMRs out in the field. In fact, precinct tabulators are generally built with significantly improved anti-tamper mechanisms compared to the older central tabulators. These measures aren't perfect of course, but it is a matter of tamper seals, cryptographic signatures, and audit tapes used by precinct tabulators as compared to absolutely no anti-tamper measures in many centralized tabulators used by jurisdictions with what many people would call "completely non-digital" voting. While it is possible to tally the ballots by hand without the assistance of OMR, and there are organizations which advocate for this, it is an extremely expensive proposal and it's actually fairly hard to argue that it is superior to a well operated OMR approach - even in the case of hand-tallying of ballots, audit recount should still be performed to ensure accuracy and integrity in the (recently recruited online, poorly paid, minimally trained, and very hurried) election officials.
- sp332 7y ago
  An audit recount is at least possible with paper ballots. If digital records are modified, how are you going to audit them?
  - jcrawfordor 7y ago
    Digital records kept by precinct tabulators are audited using the paper ballots. These machines read and retain the voter's original ballot for later inspection. if the ballot is machine-marked (done for voters with certain sensory/mobility limitations) the paper copy is produced for the voter's (or assister's) inspection prior to tabulation. This is perhaps the #1 misunderstanding of electronic voting technology that I encounter and frustrates me endlessly: the most widely used electronic voting method in the US, precinct tabulators, are a paper-ballot based system. The only change from the "traditional" approach to voting in the US is that the OMR is moved from the county elections office to the precinct polling place, which simplifies handling of the paper ballots. The paper ballots remain the "source of truth" and are retained for audit, the machine just tabulates the ballots immediately after the voter turning them in, instead of a courier delivering the ballot box to the central office for tabulation. Precinct tabulators include multiple safeguards against tampering which are far from perfect but reasonably effective against most common attacks - ultimately the safeguard against tampering is the same as it always has been, that the ballot box must be kept under watch of sworn election officials to protect the integrity of the paper ballots. Exact handling of the ballot boxes vary by jurisdiction, in this state they are entrusted to the state court system for retention for several years and can be retrieved and opened for auditing by order of a judge. Risk models for precinct tabulators are generally ballot stuffing, tampering with software in the supply chain, tampering with election configuration, or tampering with an individual OMR, such as in the polling place (this is by far the case that gets the most attention, even the security community seems to have largely not noticed the first three). Ballot stuffing is generally prevented by use of a machine "unlock" procedure (using a cryptographic token in the most common system) and review of the paper audit tape against the pollbook and/or voting permits generated by the pollbook (number of ballots on tape must match number of issued permits and the number of voters recorded as voted by the pollbook, these are independent checks in my jurisdiction although they should always be equivalent - checking both ways is actually a means of auditing the pollbook). Tampering with individual tabulators is relatively easily discovered by auditing the ballots using a different machine, which is the normal recount process in this jurisdiction. Tampering with tabulator configuration (likely by compromise of the election management system used to program the machines) can be detected by inspecting the paper audit tapes which include the machine configuration, which is normally conducted by a university political science department in this jurisdiction. This political science department also inspects the audit tape totals to audit the central office tabulation where the machine counts are added. Tampering with tabulator software in the supply chain is by far the most difficult and concerning case. In every case I have ever seen, tabulators are never connected to the internet. However, they are connected to a configuration system which may be internet connected, and could offer a (not easy but possible) route to tampering with their software. It is more likely that such tampering would occur prior to delivery of the machine or perhaps during storage. If done carefully it could be very difficult to detect by any audit method except for a hand-count of ballots. In this jurisdiction and, according to NCSL in the majority of US states, a hand-count is performed on a subset of ballots as part of the normal post-election audit process, and should detect this type of tampering unless the effect is very small. To be clear, some direct recording electronic or DRE machines are a major concern because there is no paper ballot for independent auditing. The term DRE can be confusing because some DREs produce a voter-verified paper audit trail or VVPAT which is essentially a machine-marked paper ballot which is shown to the voter prior to tabulation. These machines are considered DRE rather than precinct tabulators because they directly record the voter's preferences from the marker rather than scanning a paper ballot, however, because a paper ballot is retained they are mostly equivalent to precinct tabulators, with the downside that voters may not scrupulously verify the VVPAT since they were not required to mark it manually. Only about 28% of voters according to Pew vote using DRE machines, and according to Verified Voting about one quarter of those machines produce a VVPAT. This would suggest that about 21% of registered voters live in jurisdictions where there is no paper audit trail. This is definitely highly concerning, but is a significantly lower proportion of voters than most people who discuss this issue seem to think. The popularity of DRE equipment increased significantly after the Help America Vote act because DRE machines contain significantly more advanced accessibility features (e.g. blind and mobility-impaired voter modes) and HAVA required jurisdictions to upgrade to machines with these features. However, HAVA does not require DRE at all. Jurisdictions which centrally count ballots or use precinct tabulators can offer voters with accessibility needs a "ballot marker" which they insert their ballot into. After assisting the voter, the machine marks their ballot and returns it to them, allowing them or an assister to verify the ballot's correctness. In my experience most disabled voters prefer to have a human such as a family member or sworn election official assist them in marking their ballot anyway, since it is easier than learning to use the machine's accessibility interface modes, but the ballot marking machine offers them the option of complete privacy. In the case of perhaps the most popular precinct tabulator, ImageCase, the ballot marker is the same machine as the tabulator to save space and equipment maintenance. In this case the machine returns the ballot to the voter after marking for inspection and the voter reinserts the ballot into the same machine for tabulation. Focusing on all electronic voting methods, including precinct tabulation, as an evil, like a large portion of people in the tech community currently do, has significant downsides. Precinct tabulators, and OMR tabulation more generally, has significant advantages in terms of cost, accuracy (assuming no tampering, as in the majority of cases), and timeliness of results. Further, precinct tabulators have advantage to voters. Precinct tabulators generally sound an alert and return the ballot to the voter if there are problems tabulating it. This prevents votes being lost due to marking errors or damage to the ballot. Precinct tabulators confirm to the voter on a display that their ballot has been successfully tabulated, providing them with a higher level of confidence that their ballot will be counted than central tabulation provides. This has been a very long comment, but this is a topic about which I am extremely passionate. Those involved in advocating for changes in the mechanics of the US election system must be sufficiently knowledgeable of the actual methods and machines in use to make reasoned arguments. This includes knowing the difference between precinct tabulation of paper ballots and DRE, and especially DRE with no VVPAT. Unfortunately it seems that most of the time they do not. It doesn't help that the media and even technical experts (although not technical experts in voting) regularly conflate OMR, precinct tabulation, and DRE, and generally contribute to an impression that the majority of US voters leave no paper trail even when that is untrue. Were I president of the world, I would like to see legislation which mandates the use of a voter-marked paper ballot. This allows the significant advantages of precinct tabulators while ensuring the ability to audit the election by hand. I would further like to see legislation which requires that all jurisdictions hand-count a portion of ballots as an audit, possibly using the tiered method used in some states in which the size of the audit sample increases as the margin in a race gets smaller, eventually leading to a full hand count (this is essentially a more systematized version of the automatic recount legislation that already exists in many states). This is somewhat complicated when many people are arguing against the use of any technology in the voting process, while unaware that technology (namely centralized OMR, which is essentially strictly inferior to precinct tabulators) has been in use since the '60s and widespread since far before the introduce of problematic DREs, and unaware of the controls in place to prevent and detect tampering with these systems. Electronic voting simply does not mean that there is no auditable paper ballot - in the strong majority of cases there is. Let's focus on the real problem, which is DRE with no VVPAT (with DRE in general being desirable to eliminate due to the limitations of VVPAT), and not cause election authorities to feel that they need to hold onto their unauditable DRE systems because the public acts like the only viable alternative is a full hand-count, which is prohibitively expensive by orders of magnitude to US elections authorities which generally suffer from severely limited funding. Edit: besides fixing spelling, on a reread I realize that I should emphasize that precinct tabulators are connected to an election management system (which may be internet connected depending on the jurisdiction) prior to the election in order to program them. In some cases this is a direct network connection but more often it's a memory card that's moved from the election management system to the tabulator. They are not connected to anything during actual tabulation or at any time before the audit tapes and results card are removed. It is a sensible policy to require election management systems to be disconnected from the internet, and DHS has focused in on this issue closely in their work.
- Thorentis 7y ago
  Hand tallying of paper is used in Australia and works quite well. Sure, elections are expensive, but any change of government is. Better to do it once properly, than have an entire administration plagued by tampering accusations. It also creates great temp jobs. Whenever there is an election the AEC (Australian Electoral Commission) puts out ads for jobs on the day. The requirements (and they check this!) are that you cannot be affiliated with a party, and cannot have a public history of being involved in politics etc. You get paid a great casual hourly rate, and you can either by a polling official on the day (usher, handing out ballots), or a vote counter at night. Or if you've done it before you can be a supervisor. Each political party is allowed to appoint one scrutineer to watch the counting per-polling place to make sure that it is fair. To my knowledge there has never been an accusation of cheating or tampering in this system.
  - jcrawfordor 7y ago
    Hand-counting certainly is possible, and there are places in the US where it is still the regular process. However, besides the high cost of bringing on a sufficient number of temp employees (additionally complicated by the typical requirements that ballots be counted under supervision of both major parties), it's a real concern on the mind of election officials that hand counting is appreciably less accurate than automated tabulation. It's possible to multiply count ballots (e.g. count each batch twice and average results) but the general attitude is that ballot counts must be absolutely correct and any discrepancy prompts a complete recount. This results in a need to have each ballot individually entered by two people and compared one-for-one... the process is quite time consuming even for the relatively small number of ballots that are hand-counted in this jurisdiction due to damage that prevents the tabulators accepting them. Finally, there is the simple problem that the voter is not able to see their ballot tabulated "before their eyes," which is standard enough in most US jurisdictions that voters can get frustrated or worried if it isn't the case (e.g. due to a provisional ballot where the registration must be investigated before it can be tabulated, something that is thankfully becoming uncommon due to same-day voter registration). Once you're used to casting your ballot and "waiting for the ding and green light," it's a bit worrying to see it just stuffed in a canvas pouch. This definitely isn't a problem that can't be overcome, but I think to some extent comes down to the culture of election administration, which is that everything must be absolutely correct to the individual ballot, and as much as possible should be done directly in the polling place (since that's where most of the independent observers/challengers/scrutineers are located).
b1ur 7y ago
I'm more of a pen guy, if you want to change my paper vote you better have whiteout and a steady hand
- ixwt 7y ago
  Or they hand you a pen with disappearing ink. You'd have to use your own pen to prevent that. But how can it be trusted by the government that your pen hasn't been replaced?

The discussion over paper vs. electronic ballots tends to miss many of the largest issues in election security. DHS is correct in pointing out that we need a focus on the larger landscape of election support infrastructure. Notably, electronic pollbooks are a very important part of the voting system which cannot readily be replaced with a non-digital solution. Simply switching to paper ballots reduces the problem, but does not by any means eliminate it. Calls for paper ballots also tend to get muddled up in the realities of how ballots are counted. When paper ballots are used, they are virtually always still counted by computer using an OMR. A precinct tabulating solution, which is widely used in the US right now, simply moves the OMR from the central election office out into the polling place, and is broadly equivalent from a security perspective to what most people would call a "pure paper" solution except that the environmental exposure of the OMRs is higher because of their presence in field voting locations. However, security measures used to protect centralized OMR in jurisdictions without precinct tabulators are not necessarily any better than OMRs out in the field. In fact, precinct tabulators are generally built with significantly improved anti-tamper mechanisms compared to the older central tabulators. These measures aren't perfect of course, but it is a matter of tamper seals, cryptographic signatures, and audit tapes used by precinct tabulators as compared to absolutely no anti-tamper measures in many centralized tabulators used by jurisdictions with what many people would call "completely non-digital" voting. While it is possible to tally the ballots by hand without the assistance of OMR, and there are organizations which advocate for this, it is an extremely expensive proposal and it's actually fairly hard to argue that it is superior to a well operated OMR approach - even in the case of hand-tallying of ballots, audit recount should still be performed to ensure accuracy and integrity in the (recently recruited online, poorly paid, minimally trained, and very hurried) election officials.

sp332 7y ago
An audit recount is at least possible with paper ballots. If digital records are modified, how are you going to audit them?
- jcrawfordor 7y ago
  Digital records kept by precinct tabulators are audited using the paper ballots. These machines read and retain the voter's original ballot for later inspection. if the ballot is machine-marked (done for voters with certain sensory/mobility limitations) the paper copy is produced for the voter's (or assister's) inspection prior to tabulation. This is perhaps the #1 misunderstanding of electronic voting technology that I encounter and frustrates me endlessly: the most widely used electronic voting method in the US, precinct tabulators, are a paper-ballot based system. The only change from the "traditional" approach to voting in the US is that the OMR is moved from the county elections office to the precinct polling place, which simplifies handling of the paper ballots. The paper ballots remain the "source of truth" and are retained for audit, the machine just tabulates the ballots immediately after the voter turning them in, instead of a courier delivering the ballot box to the central office for tabulation. Precinct tabulators include multiple safeguards against tampering which are far from perfect but reasonably effective against most common attacks - ultimately the safeguard against tampering is the same as it always has been, that the ballot box must be kept under watch of sworn election officials to protect the integrity of the paper ballots. Exact handling of the ballot boxes vary by jurisdiction, in this state they are entrusted to the state court system for retention for several years and can be retrieved and opened for auditing by order of a judge. Risk models for precinct tabulators are generally ballot stuffing, tampering with software in the supply chain, tampering with election configuration, or tampering with an individual OMR, such as in the polling place (this is by far the case that gets the most attention, even the security community seems to have largely not noticed the first three). Ballot stuffing is generally prevented by use of a machine "unlock" procedure (using a cryptographic token in the most common system) and review of the paper audit tape against the pollbook and/or voting permits generated by the pollbook (number of ballots on tape must match number of issued permits and the number of voters recorded as voted by the pollbook, these are independent checks in my jurisdiction although they should always be equivalent - checking both ways is actually a means of auditing the pollbook). Tampering with individual tabulators is relatively easily discovered by auditing the ballots using a different machine, which is the normal recount process in this jurisdiction. Tampering with tabulator configuration (likely by compromise of the election management system used to program the machines) can be detected by inspecting the paper audit tapes which include the machine configuration, which is normally conducted by a university political science department in this jurisdiction. This political science department also inspects the audit tape totals to audit the central office tabulation where the machine counts are added. Tampering with tabulator software in the supply chain is by far the most difficult and concerning case. In every case I have ever seen, tabulators are never connected to the internet. However, they are connected to a configuration system which may be internet connected, and could offer a (not easy but possible) route to tampering with their software. It is more likely that such tampering would occur prior to delivery of the machine or perhaps during storage. If done carefully it could be very difficult to detect by any audit method except for a hand-count of ballots. In this jurisdiction and, according to NCSL in the majority of US states, a hand-count is performed on a subset of ballots as part of the normal post-election audit process, and should detect this type of tampering unless the effect is very small. To be clear, some direct recording electronic or DRE machines are a major concern because there is no paper ballot for independent auditing. The term DRE can be confusing because some DREs produce a voter-verified paper audit trail or VVPAT which is essentially a machine-marked paper ballot which is shown to the voter prior to tabulation. These machines are considered DRE rather than precinct tabulators because they directly record the voter's preferences from the marker rather than scanning a paper ballot, however, because a paper ballot is retained they are mostly equivalent to precinct tabulators, with the downside that voters may not scrupulously verify the VVPAT since they were not required to mark it manually. Only about 28% of voters according to Pew vote using DRE machines, and according to Verified Voting about one quarter of those machines produce a VVPAT. This would suggest that about 21% of registered voters live in jurisdictions where there is no paper audit trail. This is definitely highly concerning, but is a significantly lower proportion of voters than most people who discuss this issue seem to think. The popularity of DRE equipment increased significantly after the Help America Vote act because DRE machines contain significantly more advanced accessibility features (e.g. blind and mobility-impaired voter modes) and HAVA required jurisdictions to upgrade to machines with these features. However, HAVA does not require DRE at all. Jurisdictions which centrally count ballots or use precinct tabulators can offer voters with accessibility needs a "ballot marker" which they insert their ballot into. After assisting the voter, the machine marks their ballot and returns it to them, allowing them or an assister to verify the ballot's correctness. In my experience most disabled voters prefer to have a human such as a family member or sworn election official assist them in marking their ballot anyway, since it is easier than learning to use the machine's accessibility interface modes, but the ballot marking machine offers them the option of complete privacy. In the case of perhaps the most popular precinct tabulator, ImageCase, the ballot marker is the same machine as the tabulator to save space and equipment maintenance. In this case the machine returns the ballot to the voter after marking for inspection and the voter reinserts the ballot into the same machine for tabulation. Focusing on all electronic voting methods, including precinct tabulation, as an evil, like a large portion of people in the tech community currently do, has significant downsides. Precinct tabulators, and OMR tabulation more generally, has significant advantages in terms of cost, accuracy (assuming no tampering, as in the majority of cases), and timeliness of results. Further, precinct tabulators have advantage to voters. Precinct tabulators generally sound an alert and return the ballot to the voter if there are problems tabulating it. This prevents votes being lost due to marking errors or damage to the ballot. Precinct tabulators confirm to the voter on a display that their ballot has been successfully tabulated, providing them with a higher level of confidence that their ballot will be counted than central tabulation provides. This has been a very long comment, but this is a topic about which I am extremely passionate. Those involved in advocating for changes in the mechanics of the US election system must be sufficiently knowledgeable of the actual methods and machines in use to make reasoned arguments. This includes knowing the difference between precinct tabulation of paper ballots and DRE, and especially DRE with no VVPAT. Unfortunately it seems that most of the time they do not. It doesn't help that the media and even technical experts (although not technical experts in voting) regularly conflate OMR, precinct tabulation, and DRE, and generally contribute to an impression that the majority of US voters leave no paper trail even when that is untrue. Were I president of the world, I would like to see legislation which mandates the use of a voter-marked paper ballot. This allows the significant advantages of precinct tabulators while ensuring the ability to audit the election by hand. I would further like to see legislation which requires that all jurisdictions hand-count a portion of ballots as an audit, possibly using the tiered method used in some states in which the size of the audit sample increases as the margin in a race gets smaller, eventually leading to a full hand count (this is essentially a more systematized version of the automatic recount legislation that already exists in many states). This is somewhat complicated when many people are arguing against the use of any technology in the voting process, while unaware that technology (namely centralized OMR, which is essentially strictly inferior to precinct tabulators) has been in use since the '60s and widespread since far before the introduce of problematic DREs, and unaware of the controls in place to prevent and detect tampering with these systems. Electronic voting simply does not mean that there is no auditable paper ballot - in the strong majority of cases there is. Let's focus on the real problem, which is DRE with no VVPAT (with DRE in general being desirable to eliminate due to the limitations of VVPAT), and not cause election authorities to feel that they need to hold onto their unauditable DRE systems because the public acts like the only viable alternative is a full hand-count, which is prohibitively expensive by orders of magnitude to US elections authorities which generally suffer from severely limited funding. Edit: besides fixing spelling, on a reread I realize that I should emphasize that precinct tabulators are connected to an election management system (which may be internet connected depending on the jurisdiction) prior to the election in order to program them. In some cases this is a direct network connection but more often it's a memory card that's moved from the election management system to the tabulator. They are not connected to anything during actual tabulation or at any time before the audit tapes and results card are removed. It is a sensible policy to require election management systems to be disconnected from the internet, and DHS has focused in on this issue closely in their work.
Thorentis 7y ago
Hand tallying of paper is used in Australia and works quite well. Sure, elections are expensive, but any change of government is. Better to do it once properly, than have an entire administration plagued by tampering accusations. It also creates great temp jobs. Whenever there is an election the AEC (Australian Electoral Commission) puts out ads for jobs on the day. The requirements (and they check this!) are that you cannot be affiliated with a party, and cannot have a public history of being involved in politics etc. You get paid a great casual hourly rate, and you can either by a polling official on the day (usher, handing out ballots), or a vote counter at night. Or if you've done it before you can be a supervisor. Each political party is allowed to appoint one scrutineer to watch the counting per-polling place to make sure that it is fair. To my knowledge there has never been an accusation of cheating or tampering in this system.
- jcrawfordor 7y ago
  Hand-counting certainly is possible, and there are places in the US where it is still the regular process. However, besides the high cost of bringing on a sufficient number of temp employees (additionally complicated by the typical requirements that ballots be counted under supervision of both major parties), it's a real concern on the mind of election officials that hand counting is appreciably less accurate than automated tabulation. It's possible to multiply count ballots (e.g. count each batch twice and average results) but the general attitude is that ballot counts must be absolutely correct and any discrepancy prompts a complete recount. This results in a need to have each ballot individually entered by two people and compared one-for-one... the process is quite time consuming even for the relatively small number of ballots that are hand-counted in this jurisdiction due to damage that prevents the tabulators accepting them. Finally, there is the simple problem that the voter is not able to see their ballot tabulated "before their eyes," which is standard enough in most US jurisdictions that voters can get frustrated or worried if it isn't the case (e.g. due to a provisional ballot where the registration must be investigated before it can be tabulated, something that is thankfully becoming uncommon due to same-day voter registration). Once you're used to casting your ballot and "waiting for the ding and green light," it's a bit worrying to see it just stuffed in a canvas pouch. This definitely isn't a problem that can't be overcome, but I think to some extent comes down to the culture of election administration, which is that everything must be absolutely correct to the individual ballot, and as much as possible should be done directly in the polling place (since that's where most of the independent observers/challengers/scrutineers are located).

b1ur 7y ago

I'm more of a pen guy, if you want to change my paper vote you better have whiteout and a steady hand

ixwt 7y ago
Or they hand you a pen with disappearing ink. You'd have to use your own pen to prevent that. But how can it be trusted by the government that your pen hasn't been replaced?