Counting Votes with Computers

A talk presented by
Douglas W. Jones
to the annual meeting of
the League of Woman Voters of Johnson County,
Iowa City, Iowa

May 16, 2001
(small revisions for posting on the web, May 17, 2001)

Indexed on the web at http://www.cs.uiowa.edu/~jones/voting/

Introduction

Elections are a defining feature of democratic government, but all too frequently, we take the actual mechanics of the election for granted. We speak at length of such issues as who is allowed to vote, how campaigns are conducted, and how they are financed, but prior to the events in Florida last November, when it comes to voting, the typical description was: "You go to the polls, cast your vote, and then they count it and announce the winner."

Tonight, I would like to speak at length about how you cast your vote, who they are who count it, how they go about counting it, and how the winner is determined. I will begin by discussing this in a historical context, and then I will discuss the regulatory environment that controls this process, and finally, I will discuss changes that are on the horizon.

Those who went to the League's state convention may have heard some of what I intend to say from Sandy Steinbach, Director of Elections in the Secretary of State's office, and Mary Shultz, who just retired from the Board of Examiners for Voting Machines and Electronic Voting Systems, who served as panelists at that meeting.

A Very Brief History of Voting Machines

When most people speak of voting on paper ballots, they imagine that they are speaking of an ancient technology, but in fact, it appears that the first use of a formal paper ballot in the United States was in 1789, long after the establishment of democratic government in the American colonies, and the modern paper ballot was first used in Australia in 1858.

The great Australian innovation was to print standardized ballots at government expense, distribute them to the voters at the polling places, and require that the voters vote and return the ballots immediately. Today, the security against election fraud provided by this innovation seems obvious, but in the 19th century, it was not obvious, and it took decades for jurisdictions outside Australia to adopt this system.

A properly administered Australian paper ballot sets a very high standard, assuring voter privacy, preventing voters from revealing how they voted, and assuring an accurate and impartial count. It sets such a high standard that voters from many parts of the world find it remarkable that we in the United States are willing to trust our votes to anything else. This is particularly true of the British Commonwealth, where paper ballots remain the rule.

The search for alternative voting methods was motivated by two factors. First, the entrenched political machines of late 19th century America learned quite quickly how to craft the laws governing the counting of votes with the Australian ballot to favor their side. The basic idea is to set objective and uniform standards for counting votes -- a phrase I have chosen to deliberately mimic the recent Supreme Court decision. These standards were carefully chosen so that a skilled participant in the vote count could disqualify as many votes for the opposing party as possible. Such standards remain on the books in several states, notably Michigan. By 1910, there were jurisdictions in the United States where as many as 40 percent of all votes cast were being disqualified!

The second problem unique to the American system is the institution of the general election. Paper ballots are easy to count if there are only a few offices on the ballot, with only a few candidates per office, as is the norm in most parlementary democracies. In our general elections, it is common to find well over 30 candidates on one ballot, divided between 8 to 15 offices. An accurate hand count for ballots of this complexity is difficult and time consuming.

Lever voting machines were first used in 1892 in New York, and were so pervasive by the mid 20th century that most voters assumed that all voting machines were and would always be lever machines. Today, although they have been out of production since 1982, these machines are still in extremely widespread use.

While lever voting machines offer excellent voter privacy, they are immense machines, expensive to move and store, difficult to test, complex to maintain, and far from secure against vote fraud. Furthermore, a lever voting machine maintains no audit trail. With paper ballots, a it is possible to recount the votes if there is an allegation of fraud. With lever voting machines, there is nothing to recount!

The first new technology to challenge lever voting machines was the now infamous Votomatic voting machine. Punched cards themselves date back to the 1890's, but IBM did not introduce the Votomatic punched card voting system until 1964. The Votomatic ballot and the more recent mark-sense ballot both represent a return to the Australian Secret Ballot, but with the added benefit of an automated and, we hope, impartial vote count produced using tabulating machinery.

From a legal perspective, a ballot is an instrument, just like a deed or a check. When the ballot is deposited in the ballot box, it becomes anonymous, but just prior to the moment when the ballot is deposited, it ought to be possible to hand the ballot to the voter and ask "does this ballot properly represent your intent?". Punched card ballots fail this simple test! While the ballot is in the Votomatic machine, the voter can punch holes in it but is unable to see the ballot itself. Once removed from the machine, the voter can see the holes, but without help, the voter is unable to tell what those holes mean.

The problems with Votomatic ballots were severe enough that, by the early 1970s, IBM abandoned the technology, and in 1988, the National Bureau of Standards published a report by Roy Saltman recommending the immediate abandonment of this technology. By that time, punched card voting was the most widely used voting technology in the United States, and problems quite similar to many of the problems encountered in Florida during the last election had been encountered in many local elections.

Optical mark-sense voting systems were developed in the early 1970's by American Information Systems of Omaha, alternately in competition with and in cooperation with Westinghouse Learning Systems of Iowa City. The latter was the licensee of Lindquist's patents on the optical mark-sense scanning machine. Essentially the only advantage of mark-sense technology over punched card technology is that it uses marks on printed paper ballot. As such, it requires no special voting machine, and with proper ballot design, a voter can easily verify that the markings on the ballot exactly convey his or her intent.

Both punched-card and optical mark-sense technology were originally developed for use with centralized ballot counting machines. These machines were typically large and cumbersome machines! Counties could rarely afford more than one, so when the polls closed, the ballot boxes were transported to the central counting center to be tabulated. By the late 1970's, it became feasible to build mark-sense readers that could be installed in each polling place. More recently, precinct-count punched-card ballot readers have become available.

Precinct-count ballot tabulating machines are typically seen by the voter as somewhat complex ballot boxes, but because they count the ballots as they are deposited in the ballot box, they offer immediate vote totals for the precinct when the polls are closed, and they offer the option of detecting overvotes and other ballot problems before the voter leaves the polling place, thus allowing the voter to correct the problem.

The newest voting technology in common use today is the direct recording electronic voting machine. These were developed after microcomputers became sufficiently inexpensive that they could be incorporated into a voting machine. The first of these to be used in a polling place was developed by Shoup, one of the two companies that made lever voting machines. This machine was built to have the "look and feel" of a lever voting machine, thereby minimizing the voter education problems that always accompany changes in voting technology.

Much of the rhetoric today about voting system reform asks why we can't have voting machines that are as ubiquitous and convenient as automatic teller machines. This turn of phrase is a reference to the newest generation of direct recording voting machines; these make no attempt to emulate earlier technology, but instead, they are little more than repackaged personal computers with touch screen input and special software to make them function as voting systems.

All of today's direct recording voting machines attempt to offer far stronger audit and security tools than the old lever machines they functionally replace. Instead of simply storing vote totals on odometer wheels inside the machine, they store an electronic record called a ballot image recording each voter's choices, and they store an audit trail of all actions involving the machine, from pre-election testing to the printing of vote totals after the polls close. These records are stored in duplicate form, for example, in a hard drive in the machine as well as in a removable memory pack of some kind or on an adding machine tape inside the machine. Should any disaster strike or should a recount be requested, in theory at least, it is possible to recover the votes that have been cast on such a machine.

Unlike any system resting on paper ballots, none of the information stored inside a direct recording electronic voting machine can be said to have the status of a legal instrument. Instead, the record is created by the software within the voting machine in response to the voter's actions, and the record is only as trustworthy as the software itself. It is far from easy to test and inspect software to assure that it functions as advertised, and it is far from easy to assure that the software resident in a machine today is the same software that was authorized for use in that machine months or years ago.

Current Status

Today, only one Iowa county uses paper ballots, but in fact, many of the counties that use central-count mark-sense ballots hand-count the ballots for elections when they expected voter turnout to be small and when ballots are sufficiently simple. When only a few hundred votes are expected, this is good economics! Any use of voting machines requires elaborate pre and post election testing, and this can easily take more time than a hand count of a few hundred ballots concerning only a few issues.

Today, 7 Iowa counties representing about 7 percent of Iowa's population use lever machines. Nationally, lever machines are used by about 20 percent of the population.

The use of the Votomatic punched card voting machine has never been legal in Iowa; by the time there were counties in Iowa that were interested in moving to this technology, the problems with punched-cards were widely enough known that the law was changed to effectively prohibit their use for any but absentee ballots; the same revision to the law allowed the use of optical mark-sense and other electronic vote counting methods.

Several counties that use direct recording electronic voting machines do use punched card ballots for absentee voting. When used for absentee voting, no Votomatic machine is used; instead, the voter's instructions indicate, for example, that hole number 34 should be punched if the voter wishes to vote for John Smith. Thus, the voter can easily verify that the ballot does correctly represent his or her intent, and as such, the punched card ballot becomes an appropriate legal instrument.

Nationally, punched cards are used by about 30 percent of the population, although this percentage is falling quickly as a result of the problems in Florida.

Fully 80 percent of Iowa's voters vote on optical mark-sense ballots of one type or another. Nationally, the percentage is closer to 30 percent. In general, counties in Iowa that, had they been in other states would have adopted punched cards, have adopted mark-sense technology, and Iowa has been faster than most of the country to abandon lever machines.

Direct recording electronic voting machines are used in about 10 percent of Iowa and the nation. (Actually, it is 12 percent for Iowa and 9 percent nationally.) The adoption of this new technology has been slow, largely because it is expensive; direct recording electronic voting machines cost upward of $5000 each. Another reason for the slow adoption is that many people are rightly suspicious of any voting technology that puts the entire election system in the hands of a few highly skilled computer programmers.

New Technologies

Aside from hand counted paper ballots and lever voting machines, all of today's voting technologies rest on the use of computers, and two suggestions follow quite naturally from this: First, why should these computers operate in isolation? Why not interconnect them using some kind of network technology, and second, why not let me use my own computer to vote instead of making me use a publically owned machine in a polling place.

Today, all new precinct-count voting machines, including both direct-recording voting machines, optical mark-sense ballot readers, and punched-card ballot readers are offered with communication options. These allow the machines to electronically communicate the vote totals to a machine at the county level that computes county wide vote totals within minutes of the close of the polls.

Where modem use is impractical, the machines will electronically record the vote totals on a memory pack or diskette that may be hand carried to the county's tabulating center, and some machines even offer a wireless option, so that the machines transmit vote totals over the air. Many polling places are, after all, in building lobbies that have no telephone connections, or in township halls that have never been wired for telephone service. The precinct-count punched card machines in Cook County, for example, have wireless vote reporting, because, even if each polling place had a phone line, the central tabulating center simply cannot have enough phone lines to allow all polling places to report in within a reasonable time frame.

All of these electronic communication options raise severe security problems! How do you prevent some hacker from using his personal computer to report false totals for some precinct by phone or radio? If hand-carried memory packs are used, how do you prevent a dishonest election worker from switching a false memory pack for the pack that came from the voting machine. Today's memory packs frequently use PCMCIA technology, based on modules the size of a credit card! It takes only modest skills at sleight-of-hand to swap two cards that size, even in the presence of suspicious witnesses.

Because of these problems, it is illegal, in Iowa, to use these new electronic vote reporting technologies for anything other than reporting early totals to the press, this early report is of questionable value, although the press and the public have come to rely on it. For the official canvass, we still require that the totals for each precinct to be printed in duplicate, signed and witnessed by the precinct election workers, with one copy publically posted and the other copy hand carried to the counting center. If you are suspicious about the accurate transmission of your precinct's totals, you can go to the polling place as the polls close, take notes from the posted totals, and then check these with the totals reported for the official canvass.

Most proposals for allowing voters to use their own machines to vote in general elections suggest that this be done via the Internet. Usually, the term E-voting is used as a synonym for Internet voting. It should be clear, at this point, that there are many electronic voting technologies, and in fact, there are many non-internet options for using personal computers to vote. For example, voters could use modems to connect directly to the county offices when they vote. There are several companies that are aggressively attempting to sell Internet voting, most notably Safevote, of San Rafael, California, but this technology has many problems to overcome.

In effect, Internet voting can be classified as the use of direct-recording voting machines provided by the voter for absentee voting, with ballot transmission electronically over a public communications network. Thus, before we can accept this technology, we must assure ourselves that we trust direct-recording voting technology and that we trust electronic transmission of ballots, and then we must assure ourselves that we trust the voters to provide, maintain and secure their own voting machines!

The Regulatory Environment Today

Today, the technology we use for voting is regulated by numerous branches of government! In Iowa and most states, the counties individually own, pay for and administer the voting machines used locally. The states regulate the voting machines that may be purchased by the counties, and state laws and administrative rules determine how these machines are used. These state rules have, on many occasions, been overruled by Federal court decisions, and where civil rights issues have arisen, there has been direct Federal control of local elections. Finally, the Federal Election Commission has established voluntary standards governing voting systems, and these standards include a testing and certification process for voting equipment.

In Iowa, voting machines must be certified by the Iowa Board of Examiners for Voting Machines and Electronic Voting Systems, and we are among the growing minority of states [correciton added after giving this talk: small but growing majority of states] that require voting machines to conform to Federal Election Commission standards prior to consideration for sale in the state. I chair the Iowa Board of Examiners, and I feel that we have been moderately effective in setting reasonable standards for the voting systems we use in Iowa.

You will note that I did not say that we assure perfection or even that we have set excellent standards! The criteria on which we can disqualify a machine are weak! We can only disqualify machines if we find that they do not meet the conditions set by state law, and in many cases, I would have liked to disqualify machines but I was forced to vote for their approval because I had no legal grounds for disqualification.

Iowa's current laws governing voting systems deal fairly well with lever voting machines, moderately well with paper ballots, and weakly if at all with computerized voting systems! The weakness of the law with paper ballots is largely the result of the large scale abandonment of paper ballots in favor of lever voting machines a century ago. There seemed to be no point to perfecting the laws governing a voting technology that was being phased out. With the revival of paper ballots in the form of optical mark-sense ballots, this has come back to haunt us. The weakness of the law in the area of computerized systems is simply because all of the computerized alternatives are relatively new.

In response to the problems reported by the National Bureau of Standards with punched card voting in the mid 1980's, the Federal Election Commission developed the Performance and test Standards for Punchcard, Marksense, and Direct Recording Electronic Voting Systems, released in January 1990 and revised in April of that year.

In addition to defining terms and setting basic standards for some of the machinery used in elections, these standards establish a requirement for testing new voting systems by an independent testing authority -- independent of both the jurisdiction using the machines and the manufacturer. Unfortunately, only one testing laboratory, Wyle Labs of Huntsville Alabama, has qualified as an independent testing authority.

These standards have two major flaws. First, they are voluntary! A voting machine manufacturer who conforms to the standards has a marketing advantage over a non conforming manufacturer, but in most states, conformance is not required. Over the past decade, over 20 states [correction added after delivering this talk - over 30 states] have opted to require conformance to these standards, but many have not opted in.

The other problem with these standards is that they contain great omissions. Among these,

The exemption of industry standard components is intended to exempt such things as computer chips, disk drives, printers and modems, but it also exempts such things as Microsoft Windows, despite the fact that it is easy to figure out how Windows could be modified to selectively corrupt an election; I am aware of two voting machines that incorporate versions of Microsoft Windows.

The Microsoft example is particularly appropriate because, a year ago, Microsoft's representatives stated that they hoped to delay hearings on their antitrust case until after the election because they believed they would receive a more favorable hearing from a Bush administration, and in fact, when asked about this, candidate Bush confirmed that he did not favor the antitrust litigation. Thus, we had an organization that took a partisan position in an upcoming political race and that made a proprietary component of some of the voting machines that were used to decide that race. It can be easily shown that this component could subvert the honesty of the election machinery, yet the current standards exempt it from inspection because it is a widely accepted industry standard.

Prospects for Change

The flaws in today's voting systems exposed by general election last fall have moved counties, states and the Federal government to action. In addition, the Supreme Court decision that put an end to the recounts moved great areas of election law into the Federal domain, bringing it quite properly under the umbrella of Civil Rights law.

While I wasn't too thrilled with the process that led up to this court decision, and nor was I thrilled with the pragmatic considerations that led both sides to take the positions they took, I find myself in agreement with the court decision and look forward to the unfolding of its consequences.

There is one possible interpretation of the Supreme Court decision that worries me. The court declared that the equal protection clause requires that states adopt uniform, state-wide standards governing the interpretation of votes, but it is possible to interpret this as a demand for a uniform state-wide standard voting technology, and it is hard to see why the same argument the court used to support uniform standards within a state should not be extended to uniformity from state to state, which is to say, a single uniform Federal standard.

I am extremely wary of granting any monopoly in the field of voting machines! Today, we have a diverse marketplace, and the competition in this marketplace has fueled the development of a number of interesting new ideas. If we had a monopoly, as the result of a national standard voting technology, this progress would end.

Furthermore, if we declare any voting technology to be standard, and then discover, five or ten years down the road, that it is a flawed technology, we will have eliminated the competition, and we will have no choice but to live with that flaw! Had punched cards been the national standard last year, we would not be able to abandon them, as Florida has recently done!

Finally, if we create a monopoly, a crook intent on subverting the system must only subvert that one monopoly. If there are 4 makers of voting systems, the gain to be had by subverting one is limited. If there is only one maker, it may only be necessary to subvert only one or two people to rig next year's elections nationwide! The fewer people you have to trust, the more vulnerable you are to the subversion of any one of those people! Dispersed authority is resilient in the face of challenges, while centralized authority is vulnerable to corruption!

Unfortunately, the legislative response, at both the state and national levels, has been chaotic. Numerous voting system reform bills have been introduced in states across the country, and there are many proposals before the Federal government.

In Iowa, the creation of the Secretary of State's Election Reform Task Force led to the failure of the election reform legislation that was introduced this spring. Most of the bills failed in the "funnel" that is part of our states legislative scheme. This was a good thing! We are not in a hurry, and we do not need to hastily adopt random changes to our law! The job of the task force, which most recently met just two days ago, is to propose Iowa's reaction to the Supreme Court decision and to determine whether any changes are required to Iowa's laws governing recounts specifically and to our election law generally.

The Iowa Task Force includes representatives of Iowa's three political parties, representatives of the county auditor's association, the association of counties, the Attorney General's office, and the state elections office. I represent the Board of Examiners on the Task Force, and the group is chaired by Secretary of State Chet Culver. If we can keep to our schedule, we should have a legislative proposal in hand by this coming fall.

Even prior to the election last fall, the need to revise the Federal Election Commission standards was widely recognized! The Commission has contracted with American Management Systems, a major management and software consulting house, to undertake such a revision, and a revised standard should become available for public comment soon. Volume I is scheduled for preliminary release on June 29, and Volume II is scheduled for October 31.

Even while this revision is in progress, there are proposals before Congress to completely change the role of the Federal Election Commission and the form of Federal regulation of voting machinery!

Under the Supreme Court decision of last fall, it would appear to be within the authority of Congress to mandate standards for Federal elections. If this is done, the Federal standards governing voting machines would no-longer be voluntary, for Federal elections. Of course, states could, if they wanted, adopt other standards for local elections, but this would be economically ridiculous, so in fact, these standards would end up governing all elections.

HR 1165, the Election Voting System Standards Act of 2001, is one of the more moderate proposals to strip the Federal Election Commission of its authority over voting machines. More radical proposals would give this authority to the National Institute of Standards with very little direction, while HR 1165 would create a new commission to oversee the development of new standards and the establishment of a new National Election Systems Standards Laboratory.

It is clear that many in Congress dislikes the Federal Election Commission; nobody who has had to file campaign finance disclosure reports enjoys the process, and it certainly doesn't foster love for the bureaucracy to which those reports are directed. Nonetheless, there may be good reasons to divide the responsibilities of the Commission. The regulation of the conduct of elections and election campaigns requires expertise quite different from that required to regulate the mechanisms by which we conduct elections, and there may be good reason to support such a change.

At this point, my understanding of the legislation pending before Congress is incomplete, but I will no-doubt learn more next week. Just this afternoon, I received a call from a member of the House Science Committee staff asking if I could make it to Washington for hearings they've scheduled next Tuesday on this subject.