E-Voting News and Analysis, from the Experts

Tuesday March 08, 2005

Problems in Maryland Just Now Surfacing?

Filed under: — Joseph Lorenzo Hall @ 8:13 pm PST

It appears, if this report pans out, that there were massive systemic failures across Maryland involving Diebold AccuVote-TS machines last November; problems including lost votes, multiple machine failures and even unreadable data cartridges.

Why have we only heard about this now? It’s unclear. From the first report I’ve seen on this:

Scoop: Emerging Scandal on MD Voting Machine Performance

Montgomery County, Maryland. According to county election officials and other sources, all Maryland voting machines have been on ‘’lockdown'’ since November 2, 2004 due to statewide machine failures including 12% of machines in Montgomery County, some of which appear to have lost votes in significant numbers. The State Board of Elections convinced the media that Election Day went smoothly, when in fact there were serious statewide, systemic problems with the Diebold electronic voting machines – so serious that the SBE and Diebold still have not figured out how to prevent the loss of votes in the future.

“Election Day was anything but smooth. Votes were lost, computer cards storing votes were unreadable, thousands of error messages were reported, machines froze in mid-voting and machines refused to boot up. The problems with the machines were so widespread and serious that efforts to hide the problems have failed,” said Linda Schade, director of TrueVoteMD.org. “It is not sufficient for Diebold and the SBE to investigate themselves. They have misled the public about this problem and an independent investigation is needed. Further, these problems indicate that the Diebold machines should be decertified as required by Maryland law and as provided for in the Diebold contract. This is an opportunity to correct the mistaken purchase of paperless electronic voting machines. Diebold should refund Maryland tax dollars and we should start anew with a system that voters trust because it can be independently audited and recounts can be meaningful.”

We’ll need to see some corroboration of this report and what evidence is consistent across the report and what the Maryland elections officials have to say for themselves. I truly hope that this hasn’t been shrouded in secrecy for more than four months… that would be an unqualified disaster of the electoral system and responsibility would lie on the shoulders those we entrust to ensure our votes count.

UPDATE [2005-03-09 17:03:57]: A bit more information on this situation has surfaced in an AP story and in a few critical documents on the TrueVoteMD website.

Apparently, the Montogomery County Board of Elections just released a report, “2004 Presidential General Election Review - Lessons Learned”, which is the basis for the data cited in the story below. Note that the Maryland State Board of Elections claims to have not seen this report and disputes these numbers saying that only 12 out of approximately 3,000 machines in Montgomery County failed.

TrueVoteMD has posted copies of the report (linked to above) and an internal memo, “Montgomery County Root Cause Failure Analysis”. These documents appear to be authentic (that is, no county official is yet disputing their authenticity).

Here’s the skinny from the AP story:

Report Shows Problems With Montgomery Voting Machines

ROCKVILLE, Md. (AP) - A review of voting machines used in Montgomery County on Election day found that 7 percent of the machines had problems such as frozen screens or failed to boot up.

An additional 5 percent had vote tallies that were considerably lower than other machines used in the same precincts, causing elections officials to deem them “suspect,” according to the report drafted by the county in December for the local election board. […]

[Montgomery] county’s review of the election concluded that 189 of the units failed. Of those, 58 would not boot up and 106 had the screen freeze.

“In staff opinion, this is the most serious of the problems,” the report states of the screen freezes.

An additional 122 units had results that were deemed suspect, meaning each had 25-50 votes recorded when all other units in a polling place had more than 150 votes.

Margie Rohrer, spokeswoman for the county election board, said some of the machines have been sent to Diebold for testing. She referred all other questions to the state board. The report does not mention whether the vote tally was affected by the problems. […]

Monday January 31, 2005

Exit Poll Post Mortem

Filed under: — Felten @ 8:42 am PST

Paul Velleman at left2right has an interesting analysis of the exit poll data from the November presidential election.

His conclusions:
(1) Discrepancies between exit polls and votes cannot be explained by random chance, so the discrepancies must have had a systematic cause.
(2) Explanations given by the exit pollsters are not statistically plausible.
(3) We don’t yet have an adequate explanation. Perhaps we’ll find one after the exit pollsters release their precinct-by-precinct data.

Wednesday December 15, 2004

“Christopher Danielsen’s Voting Experience and The Nature Of Accessibility [and Human Factors]”

Filed under: — Joseph Lorenzo Hall @ 12:00 am PST

Christopher Danielsen, the editor of NFB’s The Voice of the Nation’s Blind, describes his experience casting a ballot on a Sequoia AVC Advantage (a full-face button-matrix DRE) with a braile template and instructions (“On My Voting Experience and The Nature Of Accessibility”). In addition to highlighting how difficult it is to vote with tactile templates, it provides some stark illustrations of human factors issues such as environmental conditions and voter fatigue (which can be particularly heightened with the lengthy process of reading braille… not to mention that braille literacy rates have been dropping):

The ability of a blind person to vote privately and independently does not consist merely of being able to identify which button to press, or which oval to mark, or which hole to punch in order to make a candidate selection. Sighted voters receive confirmation that their vote has been cast, and on newer equipment they are told whether they have over-voted or under-voted a race and so forth. Blind people should receive responses from the voting terminal which tell us what we have accomplished. Similarly, we should be able to navigate through contests and ballot questions at our own pace, and we should be able to review our ballot before casting it as sighted voters can. A static template can’t replace this interactive voting experience, whether that template is laid over a punch card or optically scanned ballot or a touch-screen machine. We must have response from the machine to indicate that the voting machine is accurately recording our choices and that our ballot is cast as we intended. Otherwise, we will be left only with the option of having a poll worker or a person of our choice review the ballot with us to make sure our votes are cast as we intend. While blind voters should certainly be permitted to retain the option of using assistance from another individual of our choice if we so desire, the chance to have a completely private and secret voting experience must not be denied to any blind voter. It is available to every sighted voter, and thus true equality for the blind will not be achieved in voting unless it is also available to us.

Tuesday December 14, 2004

More Information Surfaces About ES&S “Counting Backwards” Feature/Bug

Filed under: — Joseph Lorenzo Hall @ 5:00 pm PST

More information has surfaced in a letter from ES&S to Guilford County, NC, Board of Elections (provided by Joyce McCloy, PDF here and text here):

We would like to explain in further technical detail what caused this issue, should you or others at the county have questions. the 32,767 capacity limitation at a singled precinct level is a function of the design and definition of the results database used by ERM. The data storage element used to record votes at the precinct level is a two byte binary field. 32,767 is 2 to the 15th power, which is the maximum number held by a two byte word (16 bits) in memory, where the most significant bit is reserved as the sign bit (a plus or minus indicator). Additionally, ERM precinct count level data is stored in a binary computer format known as two’s complement. Data on ERM results reports are printed as the absolute value of the two’s complement of the associated data in the ERM database. This means that once the 32,767 limitation is reached, additional incremental tallies of vote results would not be printed correctly (32,768 through 65,536 would actually be represented as 65,536 to 32, 768).

While this value, 32,767 is certainly higher than any practical value that could be tabulated in a single election day precinct, the consideration of reporting all absentee ballots or early voting into a single absentee or “One Stop” precinct does hold the possibility of yielding much higher totals than what may be possible in single election day precincts.

This appears to be a case where a local jurisdiction used voting equipment out of the context of the vendor’s design. If they had used an unsigned 16-bit integer variable, they could have reported 65,536 votes.

561 Votes found in Washington

Filed under: — Joseph Lorenzo Hall @ 2:34 pm PST

Washington is in its third vote-count. There was the initial count, then a recount and now a third hand count. King county has been particularly fluctuant in its reported numbers in each of these counts. Now – where the margin of victory in the Governor’s race is 42 votes according to the second recount and 88 votes counting votes found in the current recount – King County has found 561 ballots that were improperly disqualified because signatures of a few hundred registered voters had not made it into their registration database (these signatures existed on the hard-copy registration cards) (from the Seattle Times, “Error discovery could give Gregoire election”):

The King County error came to light Sunday when Larry Phillips, chairman of the Metropolitan King County Council, was looking over a list of voters from his neighborhood whose ballots had been disqualified.

Phillips spotted his own name on the list, prompting an investigation by King County elections workers that turned up 561 improperly disqualified ballots.

King County Elections Director Dean Logan said that when workers were verifying signatures on absentee ballots, they erroneously disqualified voters whose signatures hadn’t been entered into a computer system.

Instead, Logan said, they should have double-checked with signatures on voters’ registration cards on file with the county.

This is yet another reminder that the voting system is exactly that, a system. There are many points of failure outside of the polling place and even the central tabulation activities. Any part of this system can potentially affect the outcome of the race, by accident or on purpose.

Sunday December 12, 2004

More e-voting problems

Filed under: — Joseph Lorenzo Hall @ 12:00 pm PST

(I am just going to update this post as I hear of more problems as they are reported in the press…)

These are courtesy of VotersUnite!:

Monday December 06, 2004

NRC on Electronic Voting

Filed under: — Joseph Lorenzo Hall @ 1:23 pm PST

The Committee for Electronic Voting - under the Computer Science and Telecommunications Board (CSTB) of the National Academies’ National Research Council (NRC) - recently issued a call for papers for input on what questions policy makers should be thinking about given the current state of electronic voting. Here are the whitepapers submitted (listed alphabetically by author/organization):

Hand Recount of Computer Results

Filed under: — Felten @ 10:12 am PST

Two Washington counties are going to recount e-voting results by printing them out from a computer and then counting the printouts by hand, according to an AP story.
The e-voting technology stores each vote in an electronic cartridge. These cartridges will be used to create a PDF file for each ballot, which will be printed, thus allowing a hand recount of paper ballots.

This makes no sense, obviously. If the electronic cartridges are the only available records of how people voted, then the print-then-recount-by-hand procedure can only introduce further errors. (Of course, recounting voter-verified paper ballots, had their been any, would have given us useful information about how votes were cast.)

So why is this charade going on? Presumably because Washington state law requires a recount of paper voting records when recounting a very close election, such as this year’s gubernatorial election. Perhaps the current law was adopted back before anybody foresaw the possibility of computerized voting.

This kind of problem isn’t unique to Washington state. I understand that New Jersey election laws require election machines to be examined by mechanical engineers. That made sense back when all such machines were mechanical, but it’s the wrong approach for computerized machines. Technology has moved much faster than voting law.

UPDATE (Dec. 7): One of the two affected counties (Snohomish) has asked for permission to transfer the machine votes onto computer tape, and then use a computer to recount the records on the tape, according to a Seattle Times Comments (0)

Thursday December 02, 2004

Changes Found in Alabama Recount

Filed under: — Joseph Lorenzo Hall @ 2:40 pm PST

Changes found in segregation amendment recount

The statewide recount on a measure to remove segregation-era language from Alabama’s constitution is turning up variations from the official canvass, with changes exceeding 100 votes in at least three counties.

These three counites (Hale, Macon and Madison) all use the same type of voting technology - ES&S’s Optech-III Eagle optical scan machine. (Note that 75% of all of Alabama counties use the same technology… 95% of counties use optical scan (different models)).

Not surprisingly, the totals in the counties that used DRE equipment didn’t change. That’s not the kind of thing that inspires much confidence in our crowd. If they had recounted a slew of voter-verified audit trail documents and compared to a retally of electronic ballots, that would be begin to be a proper audit… as Doug Jones, pointed out in his October 2004 CACM piece, “Auditing Elections”,

One important aspect to examine is the chain of custody for each piece of evidence pertaining to the election. What machinery produced this data, who collected it from the machine, and how was it preserved? What we need is analogous to the documentation for the chain of custody required to bring evidence to court in a criminal case.

Friday November 19, 2004

New Study of E-Voting Effects in Florida

Filed under: — Felten @ 10:09 am PST

Yesterday, a team of social scientists from UC Berkeley released a study of the effect of e-voting on county-by-county vote totals in Florida and Ohio in the recent election. It’s the first study to use proper social-science modeling methods to evaluate the effect of e-voting.

The study found counties with e-voting tended to tilt toward Bush, even after controlling for differences between counties including past voting history, income, percentage of Hispanic voters, voter turnout, and county size. The researchers estimate that e-voting caused a swing in favor of Bush of up to 260,000 votes in Florida. (A change of that many votes would not be enough to change the election’s result; Bush won Florida by about 350,000 votes.)

No e-voting effect was found in Ohio.

The study looks plausible, but I don’t have the expertise to do a really careful critique. Readers who do are invited to critique the study in the comments section.

Regardless of whether it is ultimately found credible, this study is an important step forward in the discourse about this topic. Previous analyses had shown differences, but had not controlled for the past political preferences of individual counties. Skeptics had claimed that “Dixiecrat” counties, in which many voters were registered as Democrats but habitually voted Republican, could explain the discrepancies. This study shows, at least, that the simple Dixiecrat theory is not enough to refute the claim that e-voting changed the results.

Assuming that the study’s authors did their arithmetic right, there are two possibilities. It could be that some other factor, beyond the ones that the study controlled for, can explain the discrepancies. If this is the case, we can assume somebody will show up with another study demonstrating that.

Or it could be that e-voting really did affect the result. If so, there are several ways this could have happened. One possibility is that the machines were maliciously programmed or otherwise compromised; I think this is unlikely but unfortunately the machines are designed in a way that makes this very hard to check. Or perhaps the machines made errors that tended to flip some votes from one candidate to the other. Even random errors of this sort would tend to affect the overall results, if e-voting counties different demographically from other counties (which is apparently the case in Florida). Another possibility is that e-voting affects voter behavior somehow, perhaps affecting different groups of voters differently. Maybe e-voting scares away some voters, or makes people wait longer to vote. Maybe the different user interface on e-voting systems makes straight party-line voting more likely or less likely.

This looks like the beginning of a long debate.

Thursday November 18, 2004

More Information Surfaces on Cateret County problem

Filed under: — Joseph Lorenzo Hall @ 3:14 pm PST

More information on the early-voting tabulation problem in Cateret County, NC - using the Unilect Patriot voting system - has surfaced after some additional testing (“Warning light came on, state tests reveal”). You’ll recall that the central problem here was that the system continued to allow recording of votes after its memory was full which resulted in 4,438 out of 7,536 early ballots to be lost.

It turns out that the Patriot system’s central controller (it has a central controller and a group of daisy-chained voting terminals) displayed an error message, “Voter Log Full", until the controller was reset for the next voter. However, the display continued to increment the number of ballots cast. Poll workers are not experts so I’m sure that they took the incrementing of the number of ballots cast to be evidence that votes were still being recorded. Even technical experts would admit that a message like “Voter Log Full” doesn’t sound critical on its face; it sounds like some audit log that records when ballots are cast is full, not that the machine is no longer recording ballots.

This is a great illustration of the dangers with paperless DRE voting, or, at least, voting without robust auditability. If this had been an error with an optical scan system, there would still be paper records that could be recounted. What should have the Patriot system have done? It arguably should have not allowed a single voted to be cast once full, and should not have allowed poll workers to override the error message.

Wednesday November 17, 2004

Election Verification Project Press Conference Thursday 11/18 in DC

Filed under: — Joseph Lorenzo Hall @ 5:13 am PST

There will be an important press conference this Thursday in DC (“Election Verification Project Press Conference”). Here’s the skinny (from Kim at the CVF):

WHAT:

A national coalition of voting rights and computer security experts will hold a post-election press conference to provide a preliminary analysis of electronic voting problems and solutions, and their implications for increasing voters’ confidence in the legitimacy of elections.

WHO:

  • Kim Alexander, California Voter Foundation
  • Lillie Coney, National Committee for Voting Integrity/Electronic Privacy Information Center
  • David Dill, Ph.D., Verified Voting Foundation
  • Will Doherty, Verified Voting Foundation/Election Incident Reporting System
  • Chellie Pingree, Common Cause
  • Matt Zimmerman, Electronic Frontier Foundation

WHEN:

Thursday, Nov. 18, 10:30 a.m. to 12 Noon

WHERE:

Cabinet Room
Beacon Hotel and Corporate Quarters (formerly Governor’s House Hotel)
1615 Rhode Island Avenue, N.W.
Washington, D.C.

(Metro Stop: Dupont Circle or Farragut North)

———-
The Election Verification Project is a coalition of technology, legal and voting rights organizations promoting transparency and accountability in the voting process. The Project advances reforms that reduce computerized voting risks, and fosters public confidence in the integrity and accuracy of the electoral process.

Friday November 12, 2004

Voting Problems in Indiana

Filed under: — Joseph Lorenzo Hall @ 7:19 pm PST

From a story in the National Journal’s House Race Hotline (“How Far Reaching Is This Fidlar Flop?”):

Election equipment counted straight party votes for [Democratic] candidates as Libertarian votes, in an error “that could affect election outcomes in as many” as 9 [counties]. [Democrats] discovered the error in Franklin Co. on 11/9 after noticing a final tally they couldn’t “decipher.” Fidlar, the [county’s] election equipment vendor, then notified election officials of the error on 11/10. The Franklin Co. Elections Board held an emergency meeting 11/11 and the ballots will be counted again 11/12. GOP Chair Bob Jewell: “Hopefully (the recanvassing) won’t change the outcome of the election.” Fidlar has machines in 9 [Indiana counites], including 2 in the 9th [congressional district] where Baron Hill [D] lost by fewer than 1.4K votes to Rep. Mike Sodrel [R]. Fidlar officials have said Franklin Co. “is the only county where a database error occurred” (Howey Political Report, 11/12). (emphasis and un-abbreviations added)

This is a big deal. Many people vote straight-party tickets, and every single one of those votes that were cast by Democrats in these counties will have to be accounted for. To boot, Fidlar has touchscreen machines in 4 counties in Iowa (Clay, Clayton, Plymouth, Union) and 4 counties in North Carolina (Alleghany, Bertie, Hertford, Surry). It’s hard to believe that their “database error” only occured in Indiana. Of course, we’ll need more information from these other counties and the vendor to determine if that is the case. Also note, I count 10 counties using Fidlar machines in Indiana (Elkhart, Franklin, Fulton, LaGrange, Newton, Ripley, Scott, Steuben, Switzerland, and White).

UPDATE: It appears that this problem might only affect counties that use optical scan systems provided by Fidlar (“Recount changes one Franklin Co. race”):

A Democrat gained enough votes to bump a Republican from victory in a county commissioner’s race after a recount prompted by a computer glitch in optical-scan voting.

The glitch in the Fidlar Election Co. vote-scanning system had recorded straight-Democratic Party votes for Libertarians.

Fidlar confirmed the error on Wednesday, a day after Democrats raised questions about preliminary results that included a Libertarian candidate for Congress winning 7.7 percent of the vote in Franklin County. That was more than four times the percentage of votes he had won across the entire district.

No programming problems were found in Fidlar’s optical scan Accuvote 2000 ES system, said Dana Pittman, an account manager for the Rock Island, Ill.-based company.

However, Fidlar also is verifying programming of its optical scan equipment in Wisconsin and Michigan, which, like Indiana, have straight-party voting, Vern Paddock of Fidlar technical support told the Palladium-Item of Richmond.

The Franklin County problem does not call into question any results in Wisconsin or Michigan, Bill Barrett, national sales manager for Fidlar, told The Associated Press today.

“That was an isolated incident in a single jurisdiction,” Barrett said in a telephone interview from Detroit.

Paddock, meanwhile, said programs for the Accuvote 2000 ES have been checked for all 10 Indiana counties that use the system.

So, how the heck do we have “glitches” without “programming problems” in this situation? What is going on here?

Waiting to Vote

Filed under: — Felten @ 2:37 pm PST

One of the underreported stories from last week’s election was the effect of long waiting lines at polling places. Many polling places in Ohio, for example, had lines of three hours or more. Though many voters waited, determined to cast their votes, quite a few must have been driven away. Not everybody has three hours to spend at the polling place.

A story in the Boston Phoenix, by David S. Bernstein, points to significant reductions in the number of polling places in some parts of Ohio, compared to the 2000 election. According to the article, polling places were consolidated on the theory that voters would cast their votes much more quickly on the touch-screen systems that were to be used in this year’s election. But then many counties put aside the touchscreens due to security concerns, and used the old punch-card system instead. The result is the same voting system as before, but with many fewer polling stations. Add in a higher than usual turnout and long lines result.

How did this affect the election results? Some data from the article:

Of Ohio’s 88 counties, 20 suffered a significant reduction — shutting at least 20 percent (or at least 30) of their precincts. Most of those counties have Republicans serving as Board of Elections director, including the four biggest: Cuyahoga, Montgomery, Summit, and Lucas.

Those 20 counties went heavily to Gore in 2000, 53 to 42 percent. The other 68 counties, which underwent little-to-no precinct consolidation, went exactly the opposite way in 2000: 53 to 42 percent to Bush.

In the 68 counties that kept their precinct count at or near 2000 levels, Kerry benefited more than Bush from the high turnout, getting 24 percent more votes than Gore did in 2000, while Bush increased his vote total by only 17 percent.

But in the 20 squeezed counties, the opposite happened. Bush increased his vote total by 22 percent, and Kerry won just 19 percent more than Gore in 2000.

This suggests that the long lines may have driven away more Kerry voters than Bush voters. But it’s only a suggestion at this point, not a solid inference; and in any case the effect doesn’t look big enough to call Bush’s victory into question.

It would be great to see a carefully, methodologically sound study of this issue.

Thursday November 11, 2004

Diebold Settles California Lawsuit

Filed under: — Felten @ 9:26 am PST

Diebold and the State of California have reached a settlement in the suit brought by the state against the e-voting vendor, according to an AP story. Diebold has agreed to pay the state $2.6 million, to reimburse California counties for the cost of using paper ballots rather than insecure Diebold systems in the recent election, and to make security improvements to its systems.

Settling the case allows Diebold to avoid further discovery, which probably would have revealed facts putting the company and its products in a bad light.

Saturday November 06, 2004

Open Source Software in E-voting

Filed under: — Joseph Lorenzo Hall @ 4:37 pm PST

(This is a highly abbreviated version of a forthcoming paper)

Approximately one year ago, California Secretary of State Kevin Shelley handed down the first open source software mandate (PDF) of any U.S. government official. This open source mandate came in response to a specific subsystem of electronic voting machines: the system that verifies the selections on an AVVPAT for disabled voters must run on open source software. As well, Rush Holt’s bill (HR 2239, 108th Congress) require that “No voting system shall at any time contain or use undisclosed software.”

There have been attempts in the past at coding open source election software for Internet voting. For example: Lorrie Cranor’s Sensus, MIT’s EVOX and Jason Kitcat’s GNU.FREE. All of these systems are now unmaintained, and voting over IP (a/k/a the other VoIP) has been fundamentally discredited by David Jefferson, Avi Rubin, Barbara Simons and David Wagner in their report examining the Pentagon’s SERVE project.

However, there hasn’t been a serious effort at developing an open platform for polling place voting until recently. In the past few years, the Open Voting Consortium (OVC) has developed software and a design for an open voting platform. The software, EVM2003, is written in python using XML ballot specifications and can run on a standard PC using a CD-bootable GNU/Linux called Knoppix. The OVC is currently in the middle of a fundraising campaign to get “1111 subscribers by 11/11″ to raise money for their efforts from small, grass-roots donations of $10 a pop; if you have a decent salary and less than two kids, consider give them a few bucks. (None of which should be confused with the Open Vote Foundation which intends to fork the open source Australian e-voting software called eVACS that is no longer open source)

(more…)

Friday November 05, 2004

Failures that should not have happened

Filed under: — Wagner @ 9:52 pm PST

Three congressmen asked the GAO to investigate problems reported with e-voting. This is a good thing. When a plane crashes, crash investigators descend upon the scene to learn what went wrong so that it won’t happen again, and the results of their investigation are published for the world to learn from. We need the same mindset in electronic voting.

Some of these errors sound like the sort of failure that never should have happened with any well-designed voting system. In Ohio, news stories are reporting that close to 4000 imaginary ballots were erroneously created out of thin air as votes were transmitted to election headquarters, apparently because of a transmission error. If this is indeed what happened, it is troubling. In a well-designed computer system, undetected transmission errors should essentially never occur. Checksums and similar techniques should have been able to protect the integrity of the transmission against undetected errors. It is too soon to know what actually happened, and it would be premature to draw any conclusions, but I hope this failure will be investigated closely.

Meanwhile, in Broward County, Florida, software exhibited a surprising failure mode. Their mayor is quoted as saying: “The software is not geared to count more than 32,000 votes in a precinct. So what happens when it gets to 32,000 is the software starts counting backward.” Pretty wild stuff. (There aren’t enough details to know what is going on here, but could the real threshold be 32,767 (not 32,000) votes, could it be that the number wraps around after that to -32,768 rather than counting “backwards", or could it be that the count was stored a signed 16-bit int variable? This sounds like a pretty odd failure mode.) Meanwhile, the vendor is being blamed for not fixing this defect – apparently the same thing happened two years ago in a Broward County mayoral race. This is exactly the reason we need public investigations into e-voting failures. If we don’t investigate failures, then those failures will keep recurring, and eventually they may cause real harm.

Wired News: “House Dems Seek Election Inquiry”

Filed under: — Joseph Lorenzo Hall @ 8:31 pm PST

From Kim at Wired News, “House Dems Seek Election Inquiry”:

Three congressmen sent a letter to the General Accounting Office on Friday requesting an investigation into irregularities with voting machines used in Tuesday’s elections.

The congressmen, Democratic members of the House of Representatives from Florida, New York and Michigan, cited a number of incidents that came to light in the days after the election. One was a glitch in Ohio that caused a memory card reader made by Danaher Controls to give George W. Bush 3,893 more votes than he should have received. Another was a problem with memory cards in North Carolina that caused machines made by UniLect to lose 4,500 votes cast on e-voting machines. The votes were lost when the number of votes cast on the machines exceeded the capacity of the memory cards.

[…]

In their letter, representatives John Conyers Jr. of Michigan, Jerrold Nadler of New York and Robert Wexler of Florida asked the GAO to “immediately undertake an investigation of the efficacy of voting machines and new technologies used in the 2004 election, how election officials responded to difficulties they encountered and what we can do in the future to improve our election systems and administration.”

Needed: Careful E-Voting Correlation Study

Filed under: — Felten @ 4:12 pm PST

Tuesday’s election created lots of data about voting patterns in places that used different voting technologies. Various people have done exploratory data analysis, to see how jurisdictions that used e-voting might differ from those that did not. See, for example, the analysis cited in Joe Hall’s entry below.

As a commenter ("Jon") notes, voting technology is not the only difference between Florida counties that might account for the observed differences. Counties that used e-voting tend to be larger, more densely populated, and more Democratic-leaning than those that don’t. Perhaps these differences explain the data.

To answer questions like these would require more sophisticated data analysis, probably performed by a person who does such analyses for a living. Such a person could control for differences in voter demographics, for instance, to see whether there is an e-voting effect separate from the kinds of differences cited above. Such a person could also tell us how big the remaining effect is, and whether it is statistically significant.

It would be great if some hotshot social science data analyst would agree to do such a study. I’m sure that the folks out there who have data would be willing to furnish it, and to suggest theories to test.

It’s also worth thinking about what a particular finding would tell us. It’s one thing to find an anomaly in the data; but it’s another thing to explain what could have caused it. If you can point to an anomaly, but you don’t have a plausible story about how a rational election-stealing strategy would have caused that anomaly, then you don’t have strong proof of fraud, no matter how much evidence of the anomaly’s existence you can present.

If real anomalies exist, I think it’s more likely that they’ll turn out to be caused by errors or technology failures than by e-voting fraud. Either way, a careful study of the data might be able to teach us a lot about how well various voting technologies work in practice.

More e-voting problems - from the AP news wire

Filed under: — Rubin @ 12:18 pm PST

COLUMBUS, Ohio (AP) _ An error with an electronic voting system gave President Bush 3,893 extra votes in suburban Columbus, elections officials said. Franklin County’s unofficial results had Bush receiving 4,258 votes to Democrat John Kerry’s 260 votes in a precinct in Gahanna. Records show only 638 voters cast ballots in that precinct. Bush actually received 365 votes in the precinct, Matthew Damschroder, director of the Franklin County Board of Elections, told The Columbus Dispatch. State and county election officials did not immediately respond to requests by The Associated Press for more details about the voting system and its vendor, and whether the error, if repeated elsewhere in Ohio, could have affected the outcome. Bush won the state by more than 136,000 votes, according to unofficial results, and Kerry conceded the election on Wednesday after acknowledging that 155,000 provisional ballots yet to be counted in Ohio would not change the result. The Secretary of State’s Office said Friday it could not revise Bush’s total until the county reported the error. The Ohio glitch is among a handful of computer troubles that have emerged since Tuesday’s elections. In one North Carolina county, more than 4,500 votes were lost because officials mistakenly believed a computer that stored ballots electronically could hold more data than it did. And in San Francisco, a malfunction with custom voting software could delay efforts to declare the winners of four races for county supervisor. In the Ohio precinct in question, the votes are recorded onto a cartridge. On one of the three machines at that precinct, a malfunction occurred in the recording process, Damschroder said. He could not explain how the malfunction occurred. Damschroder said people who had seen poll results on the election board’s Web site called to point out the discrepancy. The error would have been discovered when the official count for the election is performed later this month, he said. The reader also recorded zero votes in a county commissioner race on the machine. Workers checked the cartridge against memory banks in the voting machine and each showed that 115 people voted for Bush on that machine. With the other machines, the total for Bush in the precinct added up to 365 votes. Meanwhile, in San Francisco, a glitch occurred with software designed for the city’s new “ranked-choice voting,” in which voters list their top three choices for municipal offices. If no candidate gets a majority of first-place votes outright, voters’ second and third-place preferences are then distributed among candidates who weren’t eliminated in the first round. When the San Francisco Department of Elections tried a test run on Wednesday of the program that does the redistribution, some of the votes didn’t get counted and skewed the results, director John Arntz said. “All the information is there,” Arntz said. “It’s just not arriving the way it was supposed to.” A technician from the Omaha, Neb. company that designed the software, Election Systems & Software Inc., was working to diagnose and fix the problem.

Rumors of evoting fraud

Filed under: — Jefferson @ 12:02 am PST

The net is awash with rumors of evoting fraud of the kind we have all been warning are possible. I don’t know if any of these rumors are true. I doubt it, but I will at least look at the analyses.

However, regardless of whether or not there is any truth to such rumors, I expect it is now completely impossible to kill them and restore the confidence of the people who are convinced by them. The rumors now have a life of their own.

Just as it is difficult or impossible to detect a well-executed hidden fraud without a voter-verified audit trail, it is also impossible to prove there is not one.

Thursday November 04, 2004

A lawgeek in Oakland, CA mans a battery of Diebold machines

Filed under: — Joseph Lorenzo Hall @ 10:37 am PST

Brian Carver, a law student at Boalt, was a poll inspector in Oakland, CA (Alameda County) and has a long and comprehensive write-up of his 16-hour day manning a battery of 5 Diebold AccuVote-TS machines. Here’s a bulleted summary:

  • The training of poll workers is inadequate.
  • The voting machines face numerous security and technical problems.
  • About 15% of my voters refused to vote on a machine without a paper trail.
  • Most of those voters were also extremely angry that their only alternative to the machines was a “provisional paper ballot". There were numerous heated arguments about the word ‘provisional’. People do not want a provisional paper ballot that may or may not be counted and that will not be counted right away. They want a “true paper ballot” that always counts and that is counted on election day.
  • Absentee voters (and perhaps election officials) do not understand the rules for absentee voting.
  • Being a poll worker is extremely stressful and exhausting and you should fall down and worship the poll workers at each and every election you vote in from now on.
  • My view now is that the best election system is the simplest election system. In every single aspect of the election the paramount question should be: is there a simpler way to do this?

Exit Poll Data on Confidence in Vote Counting

Filed under: — Felten @ 7:12 am PST

Exit pollsters asked Americans leaving the polls whether they were confident that the votes would be counted accurately. Here are the results, omitting those who expressed no answer. Note that voters answered these questions as they left the polls, before they knew anything about the election result.

Category % Confident in Accuracy
All voters 91%
Bush voters 95%
Kerry voters 87%

Very few Nader voters were confident in vote-counting accuracy, but an accurate percentage is not available due to roundoff error in the available data.

(Based on raw data from CNN.)

Wednesday November 03, 2004

Another write-up of E-Day

Filed under: — Joseph Lorenzo Hall @ 4:50 pm PST

I’ve written up my experience on my “E-Day at the Legal Command Center in SF”. It has pictures and my characteristic blathering…

Reliability problems with Diebold TS in Alameda County, CA

Filed under: — Jefferson @ 2:53 pm PST

The following report was submitted to me by Don Dossa, a computer scientist colleague here at LLNL and an experienced election judge in Alameda County (a rank above precinct inspector and clerk). Alameda County uses Diebold TS machines.

Early on we had a lot of problems with the voter access cards not being consistently readable in the voting machines. I ended up putting 1 of my 10 VCE cards aside. The problem seemed much worse in the morning, so perhaps the cards or the readers were dirty and eventually cleaned themselves.

We had one very strange problem. On one machine, just once, when the ballot came up on the screen, there were no boxes whatsover for the voter to touch to cast a vote. I did not see this, but my wife, who is the precinct inspector, personally verified that it was not possible to vote for anyone on the first page of the ballot. She cancelled the ballot and the next time everything went fine. This was the only occurrence of this problem.

Blackboxvoting.org FOIAs Election Records

Filed under: — Felten @ 2:15 pm PST

Blackboxvoting.org says that they have filed a barrage of Freedom of Information Act requests seeking paper and electronic records relating to the conduct of yesterday’s elections.

Matt Green’s election judge experience

Filed under: — Rubin @ 1:39 pm PST

My graduate student, Matt Green, signed up to be an election judge. He lives in Baltimore City, and he worked the election there. His experience was quite different from mine. Here is Matt’s story.

Counting provisional ballots despite a concession

Filed under: — Joseph Lorenzo Hall @ 11:36 am PST

Dan Tokaji has the skinny on provisional voting in OH:

The big questions of the early morning hours are how many provisional ballots are out there in Ohio, and what process will govern the counting of those provisional ballots. Democrats are reportedly estimating that there are as many as 250,000 provisional ballots in Ohio, while the Secretary of State reportedly projects a number in the low 100,000s. My own rough estimate at this moment is at least 200,000, but no one knows for sure.

However, the AP is reporting the Kerry has conceded.

My day at the polls - part 2

Filed under: — Rubin @ 10:11 am PST

Yesterday, I worked as an election judge in Baltimore County. My experience was quite different from my day at the polls in March, where I worked the primary. Here is a write-up of my experience yesterday.

Phonecams and the Secret Ballot

Filed under: — Felten @ 9:20 am PST

Secrecy of the ballot is one of the most important security requirements for elections. Voters must be able to keep their votes secret. But that is only half of the secret ballot requirement. The other half, which is sometimes overlooked, is that a voter should not be able to prove to a third party how he voted, even if the voter wants to do so.

Allowing voters to prove how they voted opens the door to vote-buying and coercion. It’s much harder to buy a vote if the buyer can’t be sure that he is really getting what he paid for; and it’s harder to strongarm someone into voting your way if you they can undetectably vote for their own candidate. For example, if you can prove how you voted, then the boss or the union chief can tell you not to bother showing up for work the next day without proof that you voted for a certain candidate.

Most voting systems are designed to prevent voters from proving how they voted. But new recording technology allows voters to record their votes on video, using cellphone cameras or similar small devices. Alex Halderman decided to demonstrate this by recording his own vote yesterday. Alex writes:

[Yesterday] I voted for John Kerry–and I can prove it, thanks to my Nokia 6230 camera phone:

http://www.cs.princeton.edu/~jhalderm/vote04.avi

You see, my phone can record short video clips as well as still photos. Inside the election booth, I shot a clip showing my choice of candidate, my face (so you know it’s me voting), and the final lever pull that locked in the vote (so you know I didn’t change it after turning off the camera).

[I posted this at Alex’s request.]

AP Story on Voting-Machine Problems

Filed under: — Felten @ 6:49 am PST

AP reports on voters around the country noting e-voting problems and failures.

One focus of the article is the disturbing set of reports from several states about voters selecting one candidate on a touchscreen system and having another candidate show up in the review screen later. There were many reports of this happening.

Most of the reports of this problem came from Kerry voters; probably this is because Democratic voters were more aware of the incident reporting projects and so were more likely to report the problems they had.

Alfie Charles, a spokesman for one e-voting vendor, Sequoia, blames the voters, saying that they just pushed the wrong spot on the screen. This is a bit hard to square with reports that some voters tried over and over to register their vote for their candidate.

Charles did briefly mention that poll workers are supposed to recalibrate touchscreens if they are misbehaving. But he stopped short of actually admitting that any screens were miscalibrated.

Tuesday November 02, 2004

Waiting Time

Filed under: — Felten @ 5:31 pm PST

Many polling places are reporting long waits to vote. When the wait gets long enough, some people will leave and will end up not voting.

An interesting question about today’s voting is what effect the different voting technologies might be having on waiting times. If a technology allows relatively few voters to be voting simultaneously, or if it causes voters to take longer to cast their votes, then it will tend to cause long waiting times when voter turnout is high, as it is today.

One plausible conjecture is that e-voting systems in which voters must advance through a long series of screens will tend to increase voting time and hence will increase waiting time. At this point we don’t have the enough data to evaluate such conjectures reliably, but it will be interesting to see what we can determine later.

More on Voter Distrust…

Filed under: — Joseph Lorenzo Hall @ 4:51 pm PST

As Dave Wagner points out below, a good chunk of voters seem to distrust e-voting machines… one thing that is becoming clear from today’s data from EIRS is that voters also seem to distrust paper. Specifically, when e-voting machines break down, people have to use paper ballots; that’s the back-up system (unless you are unfortunate enough to be casting your vote in New Orleans where there is no paper back-up). However, people see this as “the system’s broke” and appear to be leaving polls in droves (shoddy paper ballots could also result in people thinking things are “sketchy"). Presumably, some will try back later and some will opt not to vote. That’s my depressing story of the day…

Scattered Problems Impede Some Voting (AP story)

Filed under: — Wallach @ 3:38 pm PST

Yahoo link.

Monday November 01, 2004

60 Minutes segment on e-voting

Filed under: — Rubin @ 7:28 pm PST

On October 27, 2004, the CBS show 60 Minutes - Wednesday, featured the topic of electronic voting. The segment features Connie McCormick, the Registrar of Voters for Los Angeles, stating that people want recounts to match the original vote tally, even if it means that an electronic voting machine just repeats the result it had before. She says that people do not want a recount that produces a different result.

Click here to view the streaming video of the segment (about 14 minutes, tested on a Mac - not sure how well it works with Windows).

Optical scan complexities…

Filed under: — Joseph Lorenzo Hall @ 7:26 pm PST

An interesting case just came up as election incident number 024055 in Tulsa, OK in the EIRS. The data merely says, “Smear on ballot next to Republican name, makes all democrat votes register as overvotes, optical scan.”

While futher corroboration is necessary, this points out that the right kind of smudge can mean that seemingly blank ballots are not, in fact, blank. As Doug Jones points out in his wonderful tutorial on optical scan technology, stray marks can affect the resolution of optical scanning. This case is particularly interesting as it biases a particular constituency; that is, the smudge doesn’t affect ballots where the voter chooses a Republican candidate. Further, Democratic ballots will register as having two votes in a race where only one choice is allowed which will invalidate the ballot for that race.

Tips for voters

Filed under: — Dill @ 6:09 pm PST

Based on the problems being reported in early voting in some parts of
the country (see voteprotect.org), I have the following simple
recommendations for voters. I hope that everyone can help spread the word.

  1. Prepare before going to the polls. Mark your votes in advance on
    the sample ballot that was mailed to you.

    Why?

    • We’re getting reports of long lines during early voting. This
      will make voting faster.

    • A few voters have reported that some offices were not on their
      screens, and that they didn’t discover it until they had returned
      to their home or car. If they had the list with them, any problem
      could have been detected immediately, in time to save their votes
      and perhpas get a witness to the problem.
  2. Check the review screen carefully before casting your vote.

    Why?

    • Some voters have reported votes being registered that they
      didn’t select. In the cases we’ve heard about, this seems to
      be the result of confusing machine design.

      If you check carefully, you can catch these problems before casting
      your ballot.

  3. Make sure you’ve cast your ballot! The last step is to touch a
    box on the touch-screen to cast your vote.

    Why?

    • Some voters have forgotten to do this. Depending on local
      procedures and how well they are followed, poll workers may
      finish casting your vote for you, or they may cancel your vote.
      If you make sure to finish the voting process, you can make sure
      your vote will be stored and counted.
  4. If a machine appears to be working properly, ask a poll worker.
    If the problem is not resolved, write down the name of the poll
    worker and call 1-866-OUR-VOTE when you can to report the problem.

    Why?

    • Maybe they can help you make sure your vote is counted.
    • If the problem is not resolved, there will be a witness. This
      may be important for making sure the problem is taken seriously
      and gets fixed.

Designing for DoS in Elections

Filed under: — Joseph Lorenzo Hall @ 5:53 pm PST

Along with all the benefits of using networked technology in election administration and politics, come all the bugaboos.

Specifically, we’ve seen intentional and unintentional denial-of-service (DoS). At the time of this writing, the wonderful mypollingplace.com has been brought to its knees by the heightened attention of voters trying to find their polling place (no word on the possibility that this is malicious). We’ve also seen DoS problems in Georgia, , Tennessee, Florida and Texas with the failure of electronic “poll books” in polling places connected with central registration databases. (Note: Here is a complete list of poll-book problems courtesy of VotersUnite! and their database of problems reported in the news for this election.)

In fact, the gracious Rob Malda allowed the VVF/EFF folks to plant a story on Slashdot in order to test the resiliency of a few critical web services and contingency plans that will be used by the massive Election Protection Coalition in tomorrow’s election. You might think that all of this is a tad paranoid, but there’s current litigation in New Hampshire involving a plot in the November 2002 election where one partisan group hired a telemarketing firm to keep the voter protection hotline of another group busy for most of E-Day.

To Disclose Or Not?

Filed under: — Felten @ 3:48 pm PST

Suppose, hypothetically, that I knew of a vulnerability that would allow someone to corrupt vote counts or interfere with voting on some e-voting system being used in tomorrow’s election. And suppose further that it was too late to get the vulnerability fixed. What should I do?

This is a special case of a more general issue that arises in computer security, regarding when it is proper to disclose vulnerability information. Most independent experts tend to be pro-disclosure, having learned by experience that vendors behave more responsibly when disclosure is the norm. But every situation is different, and it is often possible to withhold a little information while still getting the advantages (for the public) of disclosure.

In our hypothetical case, I think I would publish the vulnerability information once it could no longer do harm in this election. Depending on the nature of the vulnerability, that might be after the polls close in affected states, or it might be at some other time. Doing this would ensure that public officials and vendors have as long as possible to fix the problem before the next election, but that the information would be withheld during the brief window when it would help the bad guys more than the good guys.

I might want (still speaking hypothetically) to put a stake in the ground so I could prove later that I knew the vulnerability information before the election. One way to do that would be to write a short file or document describing the vulnerability, to compute the cryptographic hash of that file, which is a unique number that can be verified later but that conveys no useful information about the contents of the file, and then to publish the hash.

Perhaps I, or one of my colleagues, will publish the hash of a vulnerability report here, before the election is over.

Wired Story on Certification

Filed under: — Felten @ 1:36 pm PST

The Federally mandated certification of e-voting systems does little to ensure their accuracy and security, according to a Wired News story by Kim Zetter.

Here’s a sample:

In 1996, a federal testing lab responsible for evaluating voting systems in the United States examined the software for a new electronic voting machine made by I-Mark Systems of Omaha, Nebraska.

The tester included a note in the lab’s report praising the system for having the best voting software he had ever seen, particularly the security and use of encryption.

Doug Jones, Iowa’s chief examiner of voting equipment and a computer scientist at the University of Iowa, was struck by this note. Usually testers are careful to be impartial.

But Jones was not impressed with the system. Instead, he found poor design that used an outdated encryption scheme proven to be insecure. He later wrote that such a primitive system “should never have come to market.”

But come to market it did. By 1997, I-Mark had been purchased by Global Election Systems of McKinney, Texas, which in turn was purchased by Diebold in 2002. Diebold marketed the I-Mark machine as the AccuVote-TS and subsequently signed an exclusive $54 million contract to supply Georgia with the touch-screen machines statewide. In 2003, Maryland signed a similar agreement.

Last year, computer scientists found that the Diebold system still possessed the same flaws Jones had flagged six years earlier, despite subsequent rounds of testing.

What should a poll watcher watch?

Filed under: — Wallach @ 1:34 pm PST

I’m speaking tonight to some local citizens who want to be poll watchers tomorrow, so I wrote a detailed list of things to which they should pay attention. My advice is tailored to Harris County (Houston), Texas, although much of it should apply anywhere else with electronic voting systems. Needless to say, I’d appreciate any feedback others might have on my advice.

Biased vs. Unbiased Errors

Filed under: — Felten @ 10:59 am PST

Eric Rescorla at Educated Guesswork has an interesting discussion of how seemingly unbiased errors in voting machines can have a biased effect on election results.

Touchscreen Problems in New Mexico

Filed under: — Felten @ 10:08 am PST

Early voters in New Mexico report that when they choose one candidate, the voting machine sometimes displays a vote for a different candidate. This is reminiscent of the Texas problems Dan Wallach wrote about below.

Here’s a quote from Jim Ludwick’s story in the Albuquerque Journal:

[Kim Griffith] went to Valle Del Norte Community Center in Albuquerque, planning to vote for John Kerry. “I pushed his name, but a green check mark appeared before President Bush’s name,” she said.

Griffith erased the vote by touching the check mark at Bush’s name. That’s how a voter can alter a touch-screen ballot.

She again tried to vote for Kerry, but the screen again said she had voted for Bush. The third time, the screen agreed that her vote should go to Kerry.

She faced the same problem repeatedly as she filled out the rest of the ballot. On one item, “I had to vote five or six times,” she said.

Michael Cadigan, president of the Albuquerque City Council, had a similar experience when he voted at City Hall.

“I cast my vote for president. I voted for Kerry and a check mark for Bush appeared,” he said.

He reported the problem immediately and was shown how to alter the ballot.

Cadigan said he doesn’t think he made a mistake the first time. “I was extremely careful to accurately touch the button for my choice for president,” but the check mark appeared by the wrong name, he said.

In Sandoval County, three Rio Rancho residents said they had a similar problem, with opposite results. They said a touch-screen machine switched their presidential votes from Bush to Kerry.

This sounds like a problem with the touch sensors on the machine’s screens. Touchscreens use one mechanism to paint images onto the screen, and a separate mechanism to measure where the screen has been touched. Many touch sensors react oddly when the screen is touched in more than one place at the same time: they report a single touch between the actual touch points. If a voter rests his hand on the frame around the edge of the machine’s screen, the edge of that hand may accidentally trigger the touch sensor. If the voter then uses his other hand to choose a candidate, the touch sensor may interpret these two simultaneous touches (one at the edge of the screen, and one on the desired candidate) as a touch somewhere in between. And that may be read as a vote for the wrong candidate.

Though the detailed explanation looks different from the Texas problems Dan discussed, the big picture is the same – computerized touchscreen systems don’t behave as reasonable voters expect them to, so some votes are read for the wrong candidate. It’s like an electronic version of the infamous Palm Beach County butterfly ballot from four years ago.

Voters: remember to watch your voting machine carefully to make sure it isn’t accidentally misreading your input.

Go out and Vote!

Filed under: — Rubin @ 7:44 am PST

Despite the concerns about electronic voting, it is important for everybody to vote. The only way to guarantee without any doubt that your vote will not be counted is not to vote. Once the election is over, we can protest if we feel the machines did not work correctly or that they may have cheated. There are many ways to protest the use of paperless DREs. But, avoiding the polls out of protest is self defeating. I encourage everybody who is registered to go to the polls and vote, and then starting Wednesday, to voice your opinions to your representatives about these machines that threaten our democracy.

Sunday October 31, 2004

Human-factors issues in Houston and elsewhere

Filed under: — Wallach @ 6:00 pm PST

I’ve heard variants of this story cropping up around Texas on systems using Hart Intercivic’s eSlate voting system. The general problem goes something like this: a voter selects “straight ticket Democratic Party” and then presses the “Cast Ballot” button. The machine then presents a summary of the voter’s choices, and, to the voter’s horror, they find “Bush/Cheney” selected rather than “Kerry/Edwards". I’ve heard variants on this story elsewhere on different voting machines, but I think the eSlate story is easier to analyze.

What went wrong? Maybe we’re talking about:

  • Human-factors error: the voter pressed the wrong sequence of buttons, perhaps a result of a confusing interface.
  • Software error: a bug in the machine software caused the flip.
  • Hardware error: something physically in the machine broke or misbehaved.
  • Tampering / fraud: a deliberately fradulent modification to the machine caused the flip.

The easiest cases to dismiss are hardware errors (the machines otherwise appear to be working fine) and tampering (if you were smart enough to tamper with the software to change the results, you wouldn’t have the summary screen show the other candidate). This leaves software bugs and human-factors issues. My gut tells me we’re looking at a human-factors problem.

On this particular machine, when you select a “straight ticket” vote, it causes all races that have a candidate for the selected party to be highlighted with a red dot. Other candidates are dimmed into a grey color with lower contrast than you have before you make a selection. How could a voter get confused? The “straight ticket” selection appears as the top “race” on the ballot. You turn the “select” wheel to scroll to the party you want and press the big “enter” button. After this, the machine helpfully advances the current selection to the next race, the presidential race. If a voter were to think that the “enter” button had not done anything yet (perhaps because there is a noticable delay while it is performing the selection) and were to then press the button again, they might indeed end up selecting the top candidate on the list of presidential candidates, who just happens to be George W. Bush.

Is this the only plausible explanation for the behavior some are experiencing? Far from it. Luckily, if this is the problem, then the summary screen is the solution. It requires the voter to make sure that these selections are indeed the ones the voter wanted. And, indeed, some voters caught their mistakes and fixed them. In that sense, the system worked precisely as it was designed.

How can the vendor engineer their system to avoid the problem next time around? For starters, they could reduce the latency after selecting a straight ticket with some performance tuning of their software. They could also use a “Just a minute…” popup window of some kind to make it clear that the machine got the command and is working on processing it. They could even consider ignoring button presses that occured while the machine was busy. However, whatever they try, they need to evaluate it. It’s called the scientific method. You get a bunch of test subject voters, with demographics representing people in the real world rather than just college students, and you can experimentally compare the “control” group with the old system to the “experimental” group with the modified system. If the control group is more accurate, then you go back to the drawing board.

This kind of testing would be of fantastic value for every electronic or paper-based voting system. For example, human-factors testing would have caught the “butterfly ballot” issues in Florida in the 2000 presidential election. Such testing could be conducted by the vendor, on new software releases, and by the customers (counties, states, or other municipalities) for each new election. I suspect that human-factors testing will become a growing and important engineering step for any voting system, regardless of its technology.

(edit: I got the names of some of the buttons wrong – it’s corrected now.)

Saturday October 30, 2004

Rundown of E-voting Problems So Far

Filed under: — Felten @ 9:39 pm PDT

Donna Wentworth at EFF Deep Links has an interesting rundown on the E-voting problems that have been seen so far, in early voting, and what they teach us.

Welcome

Filed under: — Felten @ 2:08 pm PDT

Welcome to evoting-experts.com, a central source of up-to-date information and insight about e-voting, straight from some of the leading independent experts on computerized voting technology. Our distinguished panelists will post messages on the site continuously through election day and afterward.

This is a non-partisan site. Our goal here is not to advance any political agenda, but to help ensure that all votes are counted fairly and accurately, and to provide honest expert commentary to the public and the press.

(Panelists speak only for themselves, and not for their employers or other panelists.)

Powered by WordPress