Receipts for Voting MachinesTITLE> </HEAD> <BODY> <H1 ALIGN=CENTER>Receipts for Voting Machines</H1> <P ALIGN=CENTER> <SMALL> Posted on Mon, 29 Jan 2001 16:43:08 CST by<BR> </SMALL> <A HREF=http://homepage.cs.uiowa.edu/~dwjones/>Douglas W. Jones</A> <SMALL> <BR>from the University of Iowa, Iowa City, Iowa, in </SMALL> <BR> <A HREF=http://catless.ncl.ac.uk/Risks/21.23.html>comp.risks Volume 21: Issue 23</A> </P> <P ALIGN=CENTER> <SMALL> Indexed on the web at <A HREF="index.html">http://homepage.cs.uiowa.edu/~dwjones/voting/</A> </SMALL> </P> <P> An article in <I>The New York Times,</I> 28 Jan 2001, entitled "Nation Awash in Ideas for Changing Voting", included the following paragraph: <BLOCKQUOTE> Ideas include changing Election Day to a weekend or making it a federal holiday, closing polls at the same time across the country, allowing voter registration on Election Day and requiring that machines give voters receipts. </BLOCKQUOTE> Since the confusion surrounding the November election, I have heard several proposals that voting machines should give receipts. This is an extremely dangerous proposal! <P> If a voting machine gives a voter a receipt indicating the votes he or she has cast by, someone intent on buying a vote could demand to see that receipt as a condition of payment. Today, for example, unions can urge their membership to vote the union line, and employers can urge their employees to vote the company line, but they have no way of knowing if a particular member or employee followed their advice. Receipts would change this, opening the door to a class of election fraud that has not been widespread in the United States since the 19th century. <P> There are two ways to make voting machine receipts safe against this kind of fraud. One is to eliminate ballot content from the receipt, reducing it to mere proof that the voter has voted. This eliminates the value of the receipt as proof against the kinds of problems voters had in Florida last November. <P> The other approach is to issue the voter a receipt, but to deny the voter the right to take the receipt from the polling place, for example, by requiring that the voter deposit the receipt in a special box. If we do this, we may as well consider this box to be a ballot box, with the receipt being elevated to the official status of a ballot, and the voting machine, no matter how computerized, reduced in status to a ballot marking device. The official hand-recountable record of the vote then becomes the paper ballot issued by the machine. <P> Since the only votes that should be counted are those actually deposited in the ballot box, this second approach eliminates the need for the computerized voting machine to record any votes in its internal memory. Optical mark reading of machine-printed ballots should be extremely easy, but for auditability, no information should be included on the machine-printed ballot other than human-readable content, and in fact, audits of the voting machine and ballot reading software would have to include checks to make sure that there is no use of steganography to include additional information on the paper ballot that might be used to connect it to a particular voter. <P> <BLOCKQUOTE> [Note added by Peter G. Newman to the comp.risks posting:] <P> Note that Rebecca Mercuri's PhD thesis (noted here previously) provides voter confirmation of a paper record, but that record is never handled by the voter: <a href="http://www.notablesoftware.com/evote.html">http://www.notablesoftware.com/evote.html</a> </BLOCKQUOTE> <P> </BODY> </HTML>