Voting on Paper Ballots

Part of the Voting and Elections web pages
by Douglas W. Jones
THE UNIVERSITY OF IOWA Department of Computer Science


The classic Australian of paper ballot provides an excellent introduction to the system of checks and balances used to assure voter privacy and an accurate vote count in the face of a variety of threats. In this system, first used in the province of Victoria, Australia in 1858, voters are issued paper ballots at a polling place, and after the ballot is marked, voters deposit it in a ballot box. After the polls close, the box is opened, the ballots are counted by the election judges, and the totals are reported.

On the face of it, this system looks misleadingly simple, but the fact that this system was first introduced in the mid 19th century and the fact that it took decades before variations on this system to be adopted by other jurisdictions is strong evidence that this was not a trivial invention!

The threats that must be accounted for in a paper ballot election include ballot box stuffing and dishonest ballot counting. In addition, we must guard the privacy of the voter, so that voters are not subject to harassment (or worse) because of the way they cast their vote.

An analysis of the problem of carrying out an honest election begins with an enumeration of the different parties in the process. For each party, we identify of the threats that party poses and the countermeasures we can take to meet these threats. Historically, the identification of threats has frequently developed very slowly, with each threat being clearly addressed only after serious improprieties have been widely publicized. Many paper ballot voting systems in use today fail to address several threats, and even in the realm of paper ballots, technological changes threaten some of the countermeasures that have traditionally proven to be effective.

The Parties

The primary parties that interest us are the voter and the election judges, but we are also interested in several others. One important party is the outsider who tries to buy votes. Another is the agency that prints the ballots, and finally, we are concerned with assuring the security of ballot transportation and storage.

The Voter

The first party we care about in any election system is the voter! Nobody should be allowed to vote who is not entitled to vote, and nobody should be allowed to vote more than once.

There is a tradeoff between a rigorous test of voter identity, on the one hand, and a voting system where polling places are pleasant, open and inviting to voter participation. A rigorous test of voter identity could well prove sufficiently inconvenient or even humiliating that legitimate voters refuse to participate! On the other extreme, if voter identity is subject to no verification, we have no reason to believe that the election results reflect the will of the electorate.

It is probable that a system relying on imperfect tests of voter identity in order to maintain a pleasant atmosphere at the polling place will most accurately reflect the will of the electorate even though it tolerates a modest level of fraud. This will be true when the increase in legitimate turnout resulting from relaxed identity checking more than offsets the resulting increase in fraud.

Many jurisdictions do not require the voter to present any form of ID card. This may seem dangerously open to voter fraud, but there are remarkably simple countermeasures that offer what we usually consider to be adequate security. For example, if we selectively hire election judges from within the precinct, there will be a high probability that one or more judges will actually know many of the voters, making more formal identity checks unnecessary.

When the voter requests a ballot, we typically require that the voters name and address be announced so it can easily be heard by all present. If a person tries to impersonate a legitimate voter or claim residence at some address, there is a real risk that some other voter, perhaps a neighbor, will notice! Asking voters to sign a form certifying that they are indeed legitimate voters in the precinct, we gain additional security by forcing a voter intent on fraud to commit the added crime of forgery in front of a large number of witnesses.

If we assure that each voter is only allowed one trip to the voting booth and ballot box, we still have not prevented the voter from casting multiple ballots! A voter could, in theory, smuggle a stack of ballots into a polling place and stuff the lot in the ballot box! This threat is met by two countermeasures:

The accounting for ballots typically involves reconciling the number of ballots found in the ballot box at the end of the election with the number issued to voters during the voting period and the number stocked at the polling place at the beginning of the election. At the end of the day, all ballots must be accounted for as either voted, spoiled or never issued.

An interesting conflict arises between the problems of accounting for ballots and the problem of allowing voters to cast secret ballots. A classic accounting method involves attaching serial numbers to each ballot and recording these numbers whenever ballots are distributed or handled.

In order to allow secrecy, ballot forms that include serial numbers are typically prepared with a perforation between the main ballot and the tear-off tab where the number is printed. Typically, this tab is torn off by the election judge at the time the ballot is given to the voter, and at the close of polls, the number of torn tabs must equal the number of ballots cast or spoiled.

The Outsider Trying to Buy Votes

We must protect voters from outsiders who might try to punish those who vote "the wrong way" or reward those who vote "the right way". To protect voters from punishment, we must assure the voter that his vote is secret. To protect the public from voters willing to sell their votes, we must be assured that even the voters themselves cannot prove how they voted in order to claim a reward.

Additionally, because both the deposit of ballots in the ballot box and the counting of ballots are done openly, we must defend against an observer who notes the the order in which people cast ballots, and then, later, notes the the votes in the order that they are counted. Voter privacy will be compromised if these two processes are related!

An interesting approach to buying votes involves offering voters pre-voted ballots, along with the promise to buy a blank ballot from any voter who returns from the polls with one. While the voters are in the privacy of the voting booth, they are guaranteed to have ample opportunity to exchange their pre-voted ballot they smuggled into the polls for the blank ballot that was given to them by the election judges.

This scheme requires only one blank ballot to start with. After this is marked and deposited by the first voter, the perpetrator buys a blank ballot from that voter, marks it, and gives it to a second voter. Thus, a single blank ballot may be used to buy a large number of votes during the course of an election day.

This is an example of a vote fraud scheme that only works in the presence of partial security measures. If blank ballots are freely available, the perpetrator has no way of knowing how the voter got a blank ballot. If blank ballots are impossible to get, there is no way to get the single blank ballot needed at the start of the day to begin the scheme. If there is no polling place security, the perpetrator would have no need to pay voters to vote, while if every voter was searched on the way in and out, smuggling pre-voted ballots in and blank ballots out would be impossible.

Clearly, we cannot impose intimidating searches on voters; too many would be driven away, so we must concentrate on preventing blank ballots from reaching those intent on committing large-scale vote fraud. We typically do this by using ballots that are difficult to forge combined with strict accounting for all ballots printed.

Of course, few ballots are printed with the kind of anti-forgery measures that are involved in the printing of, for example, paper money; nonetheless, use of special cardstock and the distinctive print quality of letterpress printing have traditionally been judged to provided sufficient security.

The Election Judges

The election judges run the polling place and, in a precinct count system, they count the ballots. If the election judges are dishonest, they can fix the election any way they want, for example, by excluding registered voters, allowing non-registered voters to vote, stuffing the ballot box with extra ballots, discarding ballots that vote against the position they support, or simply reporting vote totals that are fictional.

We use several tools in order to guard against such fraud. Of these, the most important is openness. At no time during the conduct of the election are the judges allowed to take any action in private. For example:

This allows others present, for example, election observers, to record the names of those who voted and compare the names with lists of eligible voters, and it gives a chance for those who may know the voter by name to recognize that an impostor is attempting to vote.

When the polls close, ballot counting must be equally open. We cannot trust an election in which we allow the ballot counting to be carried out in private, behind locked doors.

Additional auditing of the counting process is possible if, for each race, in addition to counting the number of votes for each candidate, the number of overvotes and undervotes is also counted. Undervotes occur when voters fails to cast votes in a race, while overvotes occur when voters mark more than the permitted number of alternatives. In simple races, the sum of overvotes, undervotes and votes cast should add up to the number of ballots deposited in the ballot box. Slightly more complex accounting allows a similar check on races where voters may vote for more than one candidate.

As an example, it is common for political parties and campaign organizations to assign volunteers to monitor polling places, noting the names of those who have voted. In addition to supporting partisan "get out the vote" drives, these observers serve as representatives of their organizations to monitor the conduct of the election judges.

When the ballot boxes for a multiple-precinct jurisdiction are checked and sealed at a central location before being distributed to the polling places, and when full ballot boxes are taken to a central location for counting, we typically achieve a degree of openness by allowing each political party or campaign organization to send a limited number of representatives as observers.

The selection criteria used for designating the election judges who will administer the polling paces, set up the ballot boxes and count the votes provide an additional check. If we allowed one party to control the makeup of these panels that run each polling place, we would open the process to fraud. Therefore, an open election system must prevent this.

It is frequently impossible to meet both requirements; some precincts may have an insufficient number of qualified people able to work on election day, while others my be so dominated by one or another party or campaign organization that balance cannot be achieved.

In the United States, with our longstanding of two-party political tradition, election laws frequently mandate openness by requiring that members of both major parties be included on the panel of election judges, or that representatives of both major parties be invited to be present as observers during ballot box inspection and ballot counting.

Clearly, such wording is not acceptable. In the first place, in some jurisdictions, there are significant third parties that ought to be allowed representation. In some elections, there are nonpartisan races that may be supported by campaign organizations that should be allowed representation, and in jurisdictions dominated by a single party machine, opposing factions within that party ought to be allowed representation, particularly in primary elections.

Therefore, to the extent possible, we should not talk about representatives of the two major parties, but rather, representatives of each party or campaign organization.

Voters can inspect their ballots to see if they have been pre-marked, but such checking can be quite tedious, particularly if the ballot includes large numbers of issues that most voters would rather ignore. In addition, after the ballot is deposited in the ballot box, we must assure voters that no additional marks are added! Therefore, nobody but the voter must be in a position where they might be tempted to add marks to a ballot!

Furthermore, election judges themselves could attempt to buy votes by asking voters to mark their ballots in a distinctive way in order to identify themselves to the judge actually reading that ballot.

The rejection of ballots containing stray marks imposes a very strict standard on the prohibition against ballot handlers having any marking implements on them. If dishonest ballot handlers are able to mark ballots, on seeing ballots containing votes for the wrong candidates, they could invalidate them by making random marks.

Taking this to an extreme, dishonest ballot handlers have been known to carefully park fragments of pencil lead under their fingernails, allowing them to mark a ballot by casually dragging a fingertip across it. To counter this, election officials in some jurisdictions have been known to require careful inspection, trimming and cleaning of fingernails prior to any ballot handling.

The combination of the openness requirement and this requirement sets the minimum effective size for the panel of election judges, both at precincts and in vote counting centers.

In any case, in any multi-precinct election, after the results for one precinct have been computed, they must be accurately incorporated into the totals for the election district. This necessarily involves communication from precinct to regional to state offices, where successive subtotals are computed, and with each step, errors are possible, whether deliberate or accidental.

This allows observers to reconcile the numbers with their own observations of the counting, and it permits observers to check the official district-wide totals by independently computing them.

No requirement for openness or public posting of results is of any use unless there is some way to challenge an incorrect result and request that the ballots be re-counted. It is conceivable that an informal demand for a recount could be handled on the spot, but if this were done, it would be possible for an observer to arbitrarily delay the completion of the canvass of an election by repeated informal requests for recounts.

If we allow a recount request at any time, it would be possible for someone to overturn a close election at any time, possibly long after someone has begun serving in office. In the event of a close election, lingering doubts about the outcome could paralyze the government.

During the interval between the announcement of the official totals and the end of the period during which recounts are allowed, we must store all ballots for possible re-counting.

This final requirement does not mean that the candidate may not be impeached, subject to recall, or otherwise removed from office, but rather, it removes such a removal from the domain of election law.

Rules Governing Ballot Interpretation

The election judges are constrained by the laws and administrative rules imposed by the government. In the this presentation, a number of suggested regulations are presented, but these are general procedural rules. The one area where these rules are the least obvious and the most critical to the outcome of the election where the rules govern the admissibility of ballots and of individual votes on ballots.

One approach to this problem is to simply leave ballot interpretation to the election judges. This approach is sometimes classified as the "clear and obvious interpretation rule." Here, we give the election judges the authority to interpret, as a vote, any mark on a ballot which indicates the clear and obvious intent of a voter to cast a vote for one or the other candidate.

The most obvious problem with this is that it seems to give the judges a huge amount of leeway as to what marks they interpret as votes, but by requiring that election judges work in pairs, where each pair contains representatives of opposing parties, and by requiring that observers be allowed to closely observe each pair of judges, clearly biased judgements will be very difficult to hide.

A less obvious problem with this is that it allows voters to "sign" their ballots by use of a distinctive marking method. A voter could vote by initialing the box where a mark is intended, or a voter could record a binary code using Xs and check marks to represent ones and zeros, with one bit of data per office on the ballot (a long judicial retention ballot would allow for thousands of distinct codes!).

This standard is far stricter than the prohibition of stray marks on the ballot that was suggested in the previous section. It can be imposed in such a strict way that it becomes an effective tool for conducting a very crooked election!

Consider a political machine or other entrenched group desiring to preserve its power in the face of significant objections from the electorate. One way to do this is to craft voting laws in such a way that election judges have significant discretion as to which marks are acceptable as votes and which can be disregarded or used to disqualify an entire ballot.

Of course, if the two opposing judges are equally able to disqualify ballots, this poses little threat, but if the machine can control who is hired as an election judge, a natural thing to do is to hire carefully trained judges to work on behalf of the machine's party, while selecting relatively inexperienced and untrained judges as representatives of the opposition. Of course, if the opposition has the resources, they may provide training to their judges, but in the traditional machine-run metropolitan area, this has been a difficult venture.

A classical approach to enabling this kind of election manipulation has been to enact complex laws (or administrative rules) governing the acceptable forms of marks. For example, imagine a marking rule that specified that the mark shall be in the form of an X made of straight lines connecting opposite corners of the box beside the candidates name, with no part of the X protruding outside the box -- such a protrusion being considered a stray mark). A careful draftsman with a good eye may be able to make such a mark, but most voters will only approximate it. Even so, fair-minded judges are likely to ignore the fine details and accept minor deviations from this standard until they learn how strict the machine's representatives are about the slightest defects in marks for opposition candidates. By that time, a sufficient number of votes may well have been counted to determine the election!

The classical symptom of such manipulation is an unusually high percentage of votes (or ballots) being excluded for improper marking. The 1910 Encyclopedea Brittanica article on Voting Machines mentions some elections in which such rules apparently led to the exclusion of as many as 40% of the ballots cast in some elections, with exclusions being as likely in well educated upper class precincts as they were in precincts with large numbers of poor and illiterate people!

One way to prevent such absurd criteria is to enumerate the acceptable types of marks, but in Coulehan v. White, a case before the Maryland Supreme Court cited in the Encyclopedea Brittanica article on Voting Machines, 27 different styles of X were enumerated. Requiring that election judges be prepared to classify marks into such a complex scheme almost guarantees that an entrenched machine will be able to prevale over a weak opposition by ensuring that the machine's judges are better trained than those representing the opposition.

To defend against this kind of legal attack on the machinery of the election system, we may institute a mechanism such as the following:

Ballot and Ballot Box Transportation

When ballot boxes are sealed prior to an election at a central location, and when ballots are counted centrally after the polls close, when ballots are moved to storage awaiting a request for recount, and when ballots are moved from storage to the site of the recount, it is essential that tampering be prevented.

Open transport of ballot boxes might be possible, for example, if all ballots were moved in a bus along with a crowd of observers, but generally, the cost of such a scheme outweighs any benefit. In fact, if a crowd is allowed during transport, the turmoil of a moving crowd could create new opportunities for fraud.

The requirements for ballot transfer are comparable in some ways to the requirements for transfer of evidence in a criminal case. Just as we are very concerned with the chain of custody for evidence, from the policeman who observed it on the ground to the detective who put it in a bag to the evidence storage locker where it was saved prior to the trial, and finally to the person who delivered it to the courtroom, we are equally concerned with the chain of custody for ballots.

In fact, the ballots are potential evidence in a criminal trial! In the event that there is any allegation of tampering with the election, the ballots become the central evidence about which the trial revolves, and all of the steps in ballot processing become steps in the chain of custody. This chain of custody must be documented.

Ballot Storage

Secure ballot storage is essential, both between the time ballots are printed and the time the polling place opens, and between the time the votes are counted and the end of the recall interval. It is not enough that they be stored under lock and key, since this requires that we extend unlimited trust to all who have access to the key. Furthermore, all locks are vulnerable to lockpicks!