Handicapped Access to Mark-Sense Ballots

Overview

Most recent work on handicapped access to voting systems has assumed that direct recording electronic voting machines were naturally required if we want to achieve a reasonable standard of accessibility for handicapped voters. This work proposes an an optical mark-sense voting system that may meet reasonable standards for handicapped accessibility. This system should allow most blind and otherwise disabled voters to cast votes and to inspect the votes they have cast using pencil marks on a commonplace paper ballot designed for machine tabulation using a mark-sense tabulation system.

The complete system proposed here consists of a number of tools, some of which meet the needs of only one class of handicap, while others meet the needs of broad ranges of handicaps. The estimated cost of this complete suite of tools comes to under $500 per polling place. Most of these tools are shown in Figure 1 and all are listed below:

Figure 1:  Components of a handicapped accessible optical mark-sense voting system.

A pencil.

The classic tool for marking an optical mark-sense form is the number-two soft lead pencil, and this handicapped accessible voting system uses this, without modification. People with certain motor disabilities may find it easier to use a large-diameter pencil, comparable to those routinely used in lower level elementary school penmanship classes. It may be feasible to use a dry-erase or washable marker, but because of the need to avoid defacing the ballot holder, other types of marking pens should not be used with this system.

A magnifying glass.

One of the most common problems we must acommodate is mild to moderate vision impairment. Hand magnifiers are frequently used by people with such problems, and one should be provided in each polling place that is intended to be handicapped accessible. This is already done in several jurisdictions, and it should be done in all.

A ruler.

People with certain visual disorders have a very difficult time dealing with tabular material. For example, those with a limited field of vision frequently have difficulty tracking across a ballot from the candidate name to the target to be marked when casting a vote. Simple tools such as a ruler or straightedge greatly reduce this difficulty, so one should be provided in each polling place.

A ballot holder.

This multipurpose device is the subject of most of the following proposal and is the most expensive part of the proposed system; it is intended to aid both blind voters and those with moderate to severe motor disabilities as they mark their ballots. The ballot holder may be augmented with a braille overlay to acommodate blind voters, but this is needed only for those blind voters who are unable to use the headphones.

A ballot reading wand.

The ballot reading wand attaches to the ballot holder and operates as an input device to the computer system that is part of the ballot holder. Blind and illiterate voters should be able to use this to read items on the ballot. The wand includes sensors that allow blind voters and others who are curious to inspect their ballots to determine what votes the mark-sense ballot tabulator will count. The wand can be augmented to provide tactile feedback, a feature that may be useful to blind voters who have difficulty with the headphones -- the same voters who will likely benefit from a braille overlay.

Headphones.

The primary source of feedback from the ballot reader to a blind or illiterate voter should be provided by headphones. These should be hearing-aid compatible, and may include integral volume control if this is not part of the ballot holder electronics.

A privacy folder (not shown in Figure 1).

Just as privacy folders are provided to users of conventional paper ballots and optical mark-sense paper ballots, we should provide such a folder for users of this handicapped accessible voting system. This folder could be integrated with the ballot holder, or it could be a conventional paper or cardstock folder large enough to enclose the ballot holder.

A chair (not shown in Figure 1).

While many voters will be comfortable standing while they vote, a chair should be provided for those who wish to sit. The chair should be easily movable and when it is set aside, the booth should be wheelchair accessible.

It should be noted that it may not be a good idea to designate a single handicapped accessible voting booth and equip it with all of these tools while equipping none of the others. Voters who need wheelchair accessibility or who need to sit while voting may not need the magnifying glass and ruler. Voters who are blind may be perfectly comfortable voting while standing up. Therefore, it may be appropriate to keep most of these tools at the registration table, dispensing them on demand to voters who request them; if this is not done, it may be reasonable to equip more than one booth in each polling place with some or all of these tools. The ballot holder, wand and headphones, in particular, must be kept at the registration table when not in use.

The ballot holder

The proposed ballot holder is a complex piece of equipment that serves several purposes. At a gross level, the ballot holder consists of two transparent plastic sheets that sandwich the ballot, joined by an electronics assembly along one edge. Each voting target on each side of the ballot sits at the bottom of a conical hole in the ballot holder; the term voting target refers to the area of a ballot where the voter is expected to make a mark when voting for a particular candidate. The top edge of the ballot sticks out of the top of the holder, and a binder clip or some other kind of clamp should be used to prevent the ballot from sliding around in the holder during voting. In addition, the entire holder may be enclosed in a privacy folder to hide the votes that have been cast, or optionally, integral privacy covers may be attached to the holder with hinges. Figure 2 shows a ballot inserted in the ballot holder.

Figure 2:  The ballot holder.

The proposed ballot holder is designed to meet the needs of two different classes of handicapped voters:

Voters with moderate to severe motor impairments.

The ballot holder protects the face of the ballot from stray marks, preventing marking anywhere but the voting targets. The shallow conical well over each voting target helps guide the pencil point to the target and constrains marks to that target. The use of similar masks over typewriter and computer keyboards has been established for many years as an effective way to allow those with severe motor disorders to use such machinery, and it should be equally effective with mark-sense forms. Note that, so long as the voter can read the ballot through the holder, we do not rely on the electronics, and in fact, for such voters, it may be best to leave the headphones and wand detached to make the holder easier to manipulate.

Blind voters.

For blind voters, the ballot holder allows the voter to feel the locations of the voting targets. If a braille overlay is provided, voters literate in braille could vote entirely by feel once a ballot is properly inserted in the holder, but they would be unable to verify that their pencil marks were sufficiently dark to be read as votes. Because of this, and because many blind voters do not know braille, we provide a wand that works, in conjunction with the electronics in the holder. When the wand is pointed at a voting target, the electronics plays a recording over the headphones giving the candidate name and party associated with that target and a statement of whether that voting target has been marked. Optionally, the wand can also give tactile feedback when it is pointed at a marked voting target.

Illiterate voters.

The ballot holder, wand and headphones may also be used by illiterate voters to read the ballot to them. When no voters are present who need these tools, and when the polling place is not crowded, it is a good idea to let fully able voters use this system if they wish so that they may verify that it is behaving honestly.

Constraints on Ballot Design

Given that the cost of the ballot holder is likely to depend on the production volume, we are under strong pressure to get the design right prior to the first mass-production run. Therefore, we should answer some basic questions up front. How far apart should candidate names be placed on the ballot? How big should the holes over each voting target be? Do voting targets belong on the left or right side of the candidate name? It would be very bad to have made thousands of these ballot holders using one set of answers to these questions only to discover that using other answers would significantly reduce the rate of voter errors!

Figure 3 shows an extremely simple ballot in a ballot holder with the top half of the holder torn away. This ballot includes write-in blanks for each race, and two votes have been cast using identical marks made through the holes in the holder. This ballot and the holder made for it illustrate several problems we face in developing this system.

Figure 3:  A ballot in the holder with write-in blanks.

First, it is unlikely that we will be able to afford to custom build ballot holders for each distinct ballot layout! If we use this system to achieve handicapped accessibility, we will have to build ballot holders with a fixed set of holes, and then design each of our ballots to fit those holders. This is a familiar problem to designers of punched-card ballots, so we know it can be done, but the current design trend in optical mark-sense voting systems has moved toward a far greater degree of flexibility, flexibility that will be negated by the use of the proposed ballot holder!

If we pack 4 candidate names per inch in each column (one every 6.5 millimeters; this is a very common packing density on today's ballots), then we can easily put 40 voting positions in each column of a standard sheet of typewriter paper (11 inches or 28 centimeters high). If we put 3 columns on the page, this allows one-sided ballots with 120 voting positions and two-sided ballots with 240 voting positions. If we use legal size paper (14 inches or 35 centimeters high), the same constraints give us 312 voting positions. This compares favorably with punched-card ballots, where the common ballot layouts have 228, 235 and 312 punch positions.

If we design a ballot holder with 240 pre-drilled holes, most elections will only use a fraction of these. Putting the wand tip into an unused hole should make it say something like "unused ballot position." Playing this message back hundreds of times while searching for valid voting positions would be annoying, so we should plug unused holes in the ballot holder so that blind voters can easily find the valid voting positions by feel.

The optimal hole-size is partially a human factors problem, but it also depends on the unfortunate fact that paper changes size with changes in humidity. Printers frequently use the rule of thumb that a 10% increase in relative humidity causes paper to expand by about by one part in 1000; as a result, the size of a piece of bone-dry paper could expand by as much as 1% as it picks up moisture in an extremely humid environment. This comes to 1/10 inch in 10 inches, while many mark-sense voting targets are about 1/8 inch in their short dimension!

Write-in votes pose additional problems! The ballot holder shown in Figure 3 has rectangular windows in it over each write-in position. How important is the right to cast a write-in vote? Can a sufficient fraction of the blind population write a candidate name legibly in such a window? How many positions on the ballot should be reserved for write-in votes, and where on the ballot should they go?

Depending on how we answer these questions about write-in votes, we face several options:

Ban write-in voting

Most election officials hate dealing with write-in votes, and in races where the major parties have nominated candidates, most write-in votes have no effect on the outcome. Therefore, in most races, those who cast write-in votes could just as well have abstained. Unfortunately, there is one important exception to this. The major parties sometimes fail to nominate candidates for what might be considered minor local offices. When this occurs, the right to cast a write-in vote can be important!

Some of today's direct recording electronic voting systems come uncomfortably close to banning write-in votes by using nonstandard keyboard layouts on a touchscreen for write-in votes. Entering in a single write-in vote on these machines sometimes takes longer than it takes to vote the entire remainder of the ballot, even for fully able voters. The provisions these systems provide for blind voters wishing to cast write-in votes are frequently even more cumbersome!

Straight-jacket ballot layout

If we insist on a rectangular cutout over each write-in blank, if we insist on a write-in blank for each race on the ballot, and if we allow for 9 nominated candidates per partisan race, we might put a cut-out write-in window in the ballot holder every 10 voting positions down most columns of the ballot (the final column might have no write-in cutouts, being reserved for yes-no issues. All ballots designed for use in this holder would have their races laid out in terms of these write-in windows.

This constrains the ballot layout in much the way that old-fashioned lever voting machines constrain ballot layout. On such machines, one column on the face of the machine was reserved for each race, with the write-in window at the top of each column. Short voters had difficulty reaching the write-in windows on these machines, and once they wrote a name in, short voters could not easily read what they had written.

Limit the number of write-in votes allowed per ballot

If we allow only one write-in vote per ballot, or alternately one per side of the ballot or one per column, a single write-in window somewhere on the ballot, somewhere on each side, or at the bottom of each column will suffice. In this case, we may need two windows per write-in blank, one for the office title and one for the candidate name, or alternatively, a number of voting targets by each write-in blank, one per office to which the write-in blank may be applied.

This constraint on write-in voting is similar to the constraints on write-in votes on Votomatic-style punched-card ballots, where each ballot is printed with a single write-in blank on the ballot stub.

The most common style of voting target is an oval or ellipse; A round hole in the ballot holder that substantially covers such an oval or ellipse should pose no problem, as Figure 3 illustrated. The other common style of voting target is a broken arrow; these are used on the Optech line of precinct-count ballot tabulators. The same ballot holder used for elliptical voting targets should also work for the broken arrow style, as is shown in Figure 4.

Figure 4:  A broken-arrow ballot in the holder; alternate styles of write-in blanks are shown.

Most tabulators designed to count broken-arrow ballots will easily detect and count the scribble marks shown in Figure 4. In fact, most optical mark-sense ballot tabulators are not sensitive to the distinction between a broken-arrow voting target and an elliptical voting target. In some states, however, the legal definition of a valid mark on the ballot is quite strict, requiring that the mark made by the voter actually connect the two halves of the arrow. Despite the fact that most ballot tabulating machines are unable to enforce such a law, we should not use this approach to handicapped access in such states because a blind voter cannot determine whether a mark meets this legal requirement using the mechanism proposed here.

Figure 4 also illustrates two alternative styles of write-in cutout for the ballot holder. While it is certain that some blind voters will be able to write legible (if crudely block-printed) candidate names in a simple rectangular write-in cutout, it is not obvious that enough will be able to do so for this idea to be acceptable.

The ability of blind voters to use such a cut-out to guide a write-in vote may be markedly better for one cutout size than for another, so we must determine the best size for such a cutout before we commit to manufacturing. Furthermore, modified cutouts may allow an even larger number of blind voters to cast legible write-in votes. For example, we might do better with a cutout that consists of an array of rectangular holes, one for each letter of the write-in name, or we might do better if the cutout has index points along the edges to suggest an appropriate letter spacing without imposing it the way cutouts for each letter do. Both of these alternatives may limit the number of characters in the name, forcing the voter to use abbreviations and possibly limiting the use of this system in states where abbreviated candidate names are not allowed in write-in blanks.

The answer to the questions about the ability of blind voters to cast write-in votes may change if the voter is encouraged to practice with a sighted tutor prior to voting, either at the polling place or prior to arriving. It is also possible that we will conclude that the rights of blind voters are sufficiently protected if we rely on human assistance in the voting booth for write-in votes while relying on mechanical assistance for most voting.

Some of the above choices rest fundamentally on legal considerations. Depending on the design of the ballot holder, one or more state laws may have to be changed in order to use this system. In other cases, the choices we face may require human-factors experiments. Furthermore, because the use of manufactured ballot holders will preclude, for the life of the system, any major changes in ballot design, we should be very careful about a number of other human factors issues before we commit to manufacturing.

Technology

The electronics of the proposed ballot holder and wand can be broadly divided into three subsystems. First, the wand contains an optical mark-sensor. Second, the wand and pad, together, contain a system that allows the electronics to sense when the tip of the wand is pointed at a voting target, and third, the system includes the recording and playback mechanism used to give feedback to the voter.

Inside the Wand

The wand contains an optical mark sensor in its tip, a mechanism to detect the position of the wand, and optionally, a tactile feedback device, as shown in Figure 5.

Figure 5:  Components of the wand.

The optical mark sensor

There are a number of vendors for infrared proximity sensors, including Fairchild Semiconductor QRD1113, QRD1114 and QRE1113.GR, and the Panasonic CNB1001, CNB1002 and CNB1302. Competing products are made by several others. These sensors consist of an infrared light-emitting diode (LED) and a matched photodetector packaged as a single component. Visible light mark-sensing, as opposed to infrared mark-sensing, will require the use of a visible-light LED, preferably green or yellow, plus an appropriate photodetector.

Whatever the details of the mark sensor, power for the LED is provided by the electronics on the ballot holder, and the output from the photodetector is an input to the electronics. Typically, the electronics will modulate the light output from the LED and sense the amplitude of the modulated signal sensed by the photodetector in order to judge the presence or absence of a mark. The use of modulated light makes the system less sensitive to ambient lighting conditions.

The position sensing system

The electronics in the ballot holder needs some way to sense the position of the tip of the wand relative to the ballot holder. Many alternative ways for doing this have been explored since the 1960's by those interested in building graphics tablets -- pen-based graphical input devices for computers.

Almost any graphics tablet technology can be used here, but the illustration shows a mechanism that uses antenna wires in the ballot holder and a coil in the tip of the wand. The electronics in the ballot holder measure the inductive coupling between the antennas and the coil in order to determine the location of the wand tip. As shown, the antennas divide the ballot into rows and columns, so the electronics need only find which antenna loops have the strongest coupling to the wand in order to locate it -- there is no need for complex triangulation.

The optional tactile feedback mechanism

Tactile feedback is a common feature of cell-phones and pagers; the wand could contain a similar tactile feedback mechanism, used to confirm when it is pointed at a marked ballot position. One common tactile feedback mechanisms that suggests itself for this context is a small electric motor with an eccentric weight on the shaft. Another is an electromagnet operating on a spring-mounted weight.

Inside the Ballot Holder

Figure 6 shows an exploded cross-section of the ballot holder, showing all of the layers of the system except the optional privacy cover and the optional braille overlay or overlays. The following text discusses the components.

Figure 6:  Cross-section view of the ballot holder.

Top and bottom masks

In terms of bulk, these are the largest parts of the system. Made of transparent plastic, probably machined Plexiglass in prototypes and injection-molded Lexan in production models, these two sheets have tapered holes over each potential voting position on the ballot. Their primary purpose is to support and protect the ballot, but they also serve to support the guard sheets and antenna grids. It should be possible to separate the masks for cleaning, but in use, it is likely that they will be rigidly attached to the electronics along the spine of the ballot holder, with just enough space between them to allow a ballot to be slid in from the top.

Top and bottom guard sheets

The primary purpose of these sheets is to block the voting positions that are not enabled for the current election. Therefore, they must be disposable, and new sheets must be made for each election. It must be easy to observe the correct alignment of the ballot with the holder, so these sheets must be transparent. It may be possible to use vinyl overhead projector transparency film for these sheets, using something like a paper punch to punch the holes required to enable the voting positions. If the guard sheets are made of the kind of plastic used in Colorforms, they could self-adhere to the ballot holder. Alternatively, they could be clipped to the holder at the spine by the edges of the cover over the electronics, and clipped at the outer edge by the same binder clip that clamps the ballot in place. The use of a disposable guard sheet has the secondary benefit of preventing the surface of the ballot holder from becoming scratched during years of use.

Horizontal and vertical antenna grids

The antenna grids shown in the cross section are only one possible way of locating the wand relative to the ballot. In Figure 6, the vertical antenna grid is shown on the ballot side of the bottom mask, while the horizontal grid is shown on the ballot side of the top mask. This is only one possible arrangement, one that is reasonable if the antennas are made of fine wire glued into channels in the masks, or if the antennas are made using photoetched copper plating directly on the inside of the masks. If the masks are injection molded, the antenna grids may be embedded in the masks instead of applied to them after manufacturing.

Electronics

The electronics assembly could be on a separate circuit board, as shown, or it could be mounted on a flexible transparent printed circuit that also includes the antenna grids and is bonded to both top and bottom masks. The latter eliminates problems with bonding antenna wires to the electronics assemblies, but it may not be feasible if the physical size of the electronic components is large, because large components require a rigid substrate. The primary electronic components of this system are:

Batteries.

This system should use no more power than a portable cassette player such as a Sony Walkman, so it is reasonable to assume that there will be room in the electronics assembly for a battery of 2 to 4 AA or AAA cells. Tactile feedback will likely require the larger number.

The power requirements of this system should be low enough that it is reasonable to rely on battery power, but optionally, a power adapter could be included allowing the system to run from external power. In addition, when connected to external power, the system could be configured to recharge the batteries.

Power conditioning circuitry.

Battery powered microelectronics typically requires the use of a charge pump voltage regulator to produce a steady 3 or 5 volts from the variable voltage put out by the batteries. A second set of charge pumps may be needed for the audio output drive electronics.

Wand position sensing subsystem.

The antennas on the top and bottom masks may either transmit to a pickup coil in the wand, or they may receive from a transmit coil in the wand. Whichever is the transmitter will require drive electronics, and whichever is the receiver will require sensing electronics. It is likely that the lowest cost system will rest on a tri-state driver for each antenna wire, transmitting simple pulses successively on the antenna loops corresponding to the rows and columns of the ballot. The pickup coil in the wand would, in this case, be connected to a pulse detector, and all of these would be interfaced to a small microcontroller that would determine the timing of the transmitted pulses, search for detected pulses, and from these, determine the position of the wand.

Radio-frequency emission from the position sensing subsystem poses a serious problem for this position sensing subsystem, but solutions to this problem must exist because graphics tablets that use this position sensing method have been successful.

Mark sensing subsystem.

The mark sensor should only be active when the position sensing subsystem detects that the wand is over a voting target on the ballot. Assuming that the wand contains an infrared proximity photosensor, the electronics must use this to detect when the wand senses a mark. We must distinguish between ambient light and light reflected from the marked or unmarked ballot; to do this, it is reasonable to rapidly blink the infrared LED and then compare the voltage level reported by the photosensor when the LED is on with the level reported when the LED is off. This job can be done by a small microcontroller, or it may be possible to use the same microcontroller that is used for wand position sensing.

If the difference between the photosensor voltages for the LED-on and LED-off conditions is too close to zero, the wand is not sensing reflected light. When the wand is close to unmarked white paper, this difference will be high, while if the paper has been marked, this difference will be at an intermediate level. We even have the option of detecting an reporting marks that might be close to the ballot tabulator's threshold of detection. When such a mark is detected, the system could report a message such as "either darken this mark to make a clear vote or get a replacement ballot if you did not intend to make a mark here."

The mark sensing thresholds implemented by the wand must be comparable to those used in the ballot tabulating machine, and they must conform with the legal standard for what constitutes a vote.

The audio feedback subsystem

The wand position sensing subsystem and the mark sensing subsystem serve one primary purpose, to elicit audio feedback to the voter indicating whether a mark has been sensed. The audio feedback system requires an audio amplifier for the output, a small digital signal processor, and some kind of compact digital memory for the recording.

The recording for each ballot position should average about 5 seconds (The message "Abraham Lincoln, Republican, for President" can be said quite clearly in this time). If we assume a 228 position ballot, the total sound recording capacity of the system will be 5×228 or 1140 seconds. This is 19 minutes. Telephone quality audio can be reproduced with 6000 8-bit samples per second, so if our system can store 6000×1140 or 6,840,000 8-bit samples, it will be able to reproduce the necessary amount of audio information. Data compression can reduce this considerably while increasing the fidelity of the sound playback! If we do no compression, we can use a trivial digital signal processor, even a commonplace microcontroller. The more compression we do, the more complex the software required on the digital signal processor.

The estimate of 19 minutes of recorded sound can also be used as the basis for the estimated programming time for this system, per precinct, the estimated time required for a full pre-election test of the system, and the time taken by a voter who doggedly plays back the recorded message for each enabled voting target. To record or verify 19 minutes of sound will probably take 30 minutes, allowing for the time it takes to select the voting targets for which recordings are being made. Fortunately, extremely few elections will ever use every voting target on a 228 position ballot. A general election involving 10 partisan races and 10 parties, however, could easily use half of the positions on the ballot, so for such an election, recording the ballot for one polling place will frequently take 15 minutes, as will pre-election testing and the slowest voters. (These time estimates apply equally well to almost any handicapped accessible audio voting system!)

The above accounting ignores the recording requirements for the standard messages "you have voted for," "mark here to vote for," and "disabled ballot position." These do not add greatly to the above totals, even if they are recorded in several languages. (Note that there should be no need to record candidate or party names in multiple languages.) Thus, it is fair to conclude that an 8 megabyte memory will suffice; Flash EEPROM memory with this capacity is available and suitable for this function.

Controls and indicators.

In voting mode, this system should have no user accessible controls except the on-off switch and the volume control for the headphones. Depending on how the system is programmed, there may be no other operating mode! For example, if the flash EEPROM used for the sound recording is removable, programming may be done externally.

A fully self-contained system, on the other hand, would require a microphone for sound input. In this case, there could be an external switch to put the system into programming mode, or if an external microphone is used, the system could sense the presence of the microphone and enter programming mode whenever the microphone is plugged in.

The system should have a status indicator, perhaps an LED, to warn that the system is in programming mode, and it should have a second indicator that comes on when the machine is actually recording. When in programming mode, the wand can be used as a control input to select the voting target for which a recording is being made or to select the special message that is being recorded. Additional antenna loops may need to be included in the holder for the latter; these loops should only be active in recording mode.

Cover over electronics

The cover could serve to secure the electronics assembly and top and bottom masks, or it could be clipped on over them, relying on some other mechanism to secure these parts. The edges of the cover can be made to serve as clamps for the top and bottom guard sheets or for braille overlays, but if the guard sheets adhere to the top and bottom masks, this may not be needed. An integral privacy folder could also be hinged to the cover.

Security and Audit Requirements

For any voting system, we must have an assurance that the system behaves as intended when used by voters in the privacy of the voting booth We typically assure this through a combination of the following means:

Design audit

The design of the system, both hardware and software, should be inspected to determine if there are any features that could misbehave.

Manufacturing and delivery audit

The construction of the system should be monitored to assure that the systems, as built and delivered, conform to the design that was approved.

Pre-election programming

The mechanism for routine loading of information specific to a particular election should not be able to change the approved design or general function of the system.

Pre-election test

Prior to an election, the system should be tested to verify that it behaves as required.

Post-election test

After an election, particularly in the event that there are charges of irregularity, it should be possible to test the system to verify its function, and if there is any possibility of hidden functionality that cannot be disclosed by testing, it should be possible to verify that the system, as used during the election, conformed to the design that was approved.

Figure 7 shows the internal structure of the electronics that will be assumed for the purpose of the following discussion of the application of these requirements to this system. The system pictured in the figure is self-contained, with no external components other than the wand, microphone (if not built-in) and headphones, and no external connections allowing modification to the firmware or to the contents of the flash EEPROM used for audio recording.

Figure 7:  An auditor's view of system structure (simplified).

If the system is implemented using three separate microcontrollers, one for each subsystem, and communicating over unidirectional data paths following the outline in Figure 7, the design auditor's job will be significantly simplified.

There is no persistant real-time clock anywhere in the system. Therefore, the system cannot be programmed to behave one way during testing and another way on election day, using the date and time to trigger its improper behavior. Therefore, an attempt to program this mechanism to behave improperly when the polls are open but not at other times would require some kind of user input after the machine is turned on.

The data path design given in Figure 7 prevents the wand position subsystem from being aware of the markings found on the ballot and it prevents the mark-sense subsystem from being aware of the position of the wand or the operating mode. Therefore, any special control input to place the machine in an improper operating mode cannot involve interaction of these two subsystems.

If the mark-sense subsystem and speech subsystem are powered down or reset when they are not enabled, and if these subsystems have no persistent memory other than the actual spoken messages stored in the flash EEPROM, then these systems begin operating with a clean slate each time the wand is moved to a new voting position on the ballot. As a result, neither the mark-sense subsystem nor the speech subsystem can contain hidden functions that are evoked by, for example, some obscure sequence of inputs from the wand or mark-sense systems.

The wand position subsystem can potentially be programmed to remember the sequence and timing of inputs and behave in an improper way if voting targets are accessed in an odd order. For example, a programmer might arrange things so that turning the system on while pointing the wand at voting target 47 would make it behave in an improper way. Therefore, the design and source code audit should verify that the wand position subsystem retains no state information from one search for the wand position to the next.

The speech subsystem has access to the flash EEPROM, and it could potentially store historical information there, using this to trigger inappropriate behavior or to illegally store a record of the votes cast by the voter. To prevent this, the design audit should verify that the system cannot store data in the flash EEPROM except when it is in recording mode, and that it does not store anything there but audio recordings and their connections to ballot locations.

The status indicators allow major aspects of the wand position subsystem and the mark-sense subsystem to be completely and easily tested without regard to the information stored by the speech subsystem.

The pre-election test, therefore, should include an observation of these indicators as the wand is pointed at each enabled voting position on the ballot, as well as listening to the recording for each position to verify that it matches what is printed on a test ballot, and then marking some voting positions on the test ballot to verify that the report of the marking is correct.

Once the system has been verified to be correctly programmed for a particular election, a physical seal should be put over the microphone input and over the record/voting mode switch (if this is not integral to the microphone jack). This seal should also prevent the cover over the electronics from being opened or removed. So long as this seal is unbroken, election day testing and post-election testing of the system should show that it matches the ballot for which it was prepared.

Each time a voter requires the use of the ballot holder, polling place officials should verify, that the voting targets align correctly with the holes in the guard sheets and mask after they have clamped the ballot in place so that it will not slip. They should also randomly sample some of the voting positions with the wand and verify that the recordings for those positions are correct before they put the holder in a privacy folder and give it to the voter.

Some commentators have suggested that each voter should demonstrate their understanding of the ballot marking instructions prior to entering the voting booth, for example, by having a voting target on the affidavit of elegibility that the voter signs to request a ballot. If we move this test voting target to the ballot itself, we can use it to allow the voter to complete the pre-voting test by marking the test target and then checking that the wand can read the voter's own mark on the real ballot.

Cost Projection

A preliminary cost estimate for the proposed system requires greater design detail than was given previously; nonetheless, the estimate that follows should be taken in very rough terms. This estimate is not based on a full design, but rather on guesses about the types of components that will suffice. While many of the costs are almost certainly overestimated, many minor components have almost certainly been overlooked, and some major costs may have been seriously underestimated or omitted; as a result, it is reasonable to guess that the total cost for components of the system will be somewhere near the estimate given and probably not twice this sum.

Auxiliary Items
Ruler	$1
Magnifier	$10
Headphones	$15
-total-	$26
Ballot Holder
Lexan top and bottom masks	$20
Aluminum electronics cover	$1
Circuit board @ $1.00/sq-in	$14
Position sense micro...	$5
Mark-sensor microcontroller	$5
Speech microcontroller	$5
8x8meg flash EEPROM	$40
Oscillator	$3
Antenna interfaces	$18
Connector for wand	$1
Connector for AC adapter	$1
Connector for headphones	$1
Microphone	$1
Audio amplifier	$1
Volume control	$2
Programming mode switch	$1
LED indicators	$3
Battery holder	$1
Power conditioning circuitry	$10
-total-	$133
Wand
Housing	$5
Circuit board @ $1.00/sq-in	$2
Proximity photosensor	$1
Pickup coil	$1
Cord and connector	$3
-total-	$12
Grand Totals
Auxiliary items	$26
Ballot holder	$133
Wand	$12
--total--	$171

To this, we must add the cost of manufacturing, but this is unlikely to double the figure. From this, it is fair to guess that the total cost of equipping a mark-sense polling place for handicapped accessible voting is likely to be around $250, and even if warehousing and distribution costs plus a fair profit margin double the cost, we can still expect the total to be under $500.

Patents

US Patent 5,585,612, granted December 17, 1996, includes broad coverage of audio feedback for handicapped voters, but focuses on the use of a tactile map, with spoken direcitons for navigating the map to a particular voting target. It also includes the idea of a guide to allow a marker to be used to mark the target through a hole in a mask, and it includes audio feedback about how a vote was cast. Unlike the ideas presented here, the map is followed by the voter under instruction from the audio mechanism, instead of having the audio mechanism respond to the voter's position on the ballot.

In July 2003, I learned that the proposal here has competition, a device called the AutoMark voting system from Vogue Election Systems, advertised to be available starting in the fall of 2003. That system looks viable, but at a price that I'd guess would be from $2000 to $5000 per polling place, 10 times my estimate for the device described here.

This document was written as an invention disclosure to the University of Iowa Research Foundation, leading to the patent application filed on Sept. 8, 2002.

The first public disclosure of the ideas presented here were was in the section on Handicapped Access in "Voting System Standards, Work that Remains to be Done," by Douglas W. Jones, testimony presented on April 17, 2002, at a public hearing of the Federal Election Commission in Washington DC. Indexed on the web at: http://homepage.cs.uiowa.edu/~dwjones/voting/fec3.html#access

The germ from which these ideas came was planted by Jim Dickson of the American Association of People with Disabilities as we ate dinner together after the January 11 2001 public hearing before the United States Civil Rights Commission in Talahassee. Jim Dickson has examined this material, and he is not convinced that the invention disclosed here would be a useful improvement; neither he nor the AAPD endorse this device. Clearly, there is room for additional work and innovation.

The final paragraph of the followup I submitted to the Civil Rights Commission on February 15 2001 presents my first proposal for the device that evolved into the ballot holder described here. This is indexed on the web at: http://homepage.cs.uiowa.edu/~dwjones/voting/uscrc1.html