Scientists Question Electronic Voting

SFGate ^ | March 3, 2003 | Henry Norr

[Shermy]

Oddly enough, Silicon Valley has been a laggard when it comes to applying the technology it's famous for to the election process. Now it's finally beginning to catch up, and it has suddenly become the locus of an overdue -- and profoundly important -- debate about the mechanics of democracy in the 21st century.

[supercat]

Or it could be done using programable Rom that would delete the corrupt part of the program after the vote.

It's easy to design the hardware so that is not possible. Further, if the code is stored in bipolar PROM and the chip is protected from physical tampering (using serialized seals, etc.) while allowing electrical access, then it's possible to protect the PROM against alteration by including at the end three bytes indicating how many "unburned" bits there are in the PROM [these bytes may have to be inverted depending upon the default state of the PROM]. Once the check bytes are "burned in", it is physically impossible to alter the PROM contants without such alteration being detectable.

[supercat]

Unfortunately, many electronic systems not only add new weaknesses, but they also fail to correct the problems of paper ballots.

Whereas previously there were 2 weaknesses, now there are 2+X. Paper ballots win.

I have outlined a system design which would avoid the above two problems with paper ballots (elsewhere, BTW, I've outlined elsewhere a design for a mechanical system which would do even better and allow voters to physically confirm that their vote was counted while maintaining anonymity. Any interest in my rehashing that one?

[_Jim]

- Open Source - any technique used should be open-source for all to examine, test, hack and crack.

- Hashing/Hamming/Convolutional codes - 'hashes'/coding of each vote cast - hashes/ECC coding accompanies each 'vote record' image en route to tallying data base. This would be used a check/to correct against hand massaging of vote records.

- Encryption - used on all data I/O between 'boxes'

- Challenge and Authenticate protocols - used between boxes/voting machines and tally centers. All machines must have an ID assigned must be made known to others through a hierarchal structure worked out BEFORE hand - machines not meeting hierarchy will not communicate ...

Just a few points to consider in a system ...

[supercat]

While open source is certainly a requirement, I think the other items are not so necessary. The key requirements, which you don't address, are that the software be configured indelibly, and that votes be stored indelibly upon being cast. Beyond that, I'd suggest that there's one use for a secure one-way hash function: have all precincts report a secure one-way hash of their election results before any report the election results themselves. That would avoid giving crooks the information they need to cook "just enough" votes.

[boris]

"He who controls the count controls the vote."

All that need be said.

--Boris

[Theyknow]

"Consider the following design: votes are stored on a bipolar 32Kx8 PROM encased in a clear tamper-evident package with serialized seals provided by both/all parties. Initially, the PROM is blank except for a header identifying it. Past the header (assume it's 768 bytes), the PROM is divided into one thousand 32-byte blocks (which, as noted above, are initially all blank). "

"Every time someone casts a ballot, the contents of their ballot are converted to a 192-bit blob organized as 32 6-bit bytes. These are run through a lookup table to convert them into 8-bit bytes which have exactly four "1" and four "0" bits. These 32 bytes are then stored in a randomly-selected vacant block in the PROM."

"Tell me how anyone could delete any votes from such a system without the alteration being obvious."

Whatever you said makes no sence to me. Or to the overwhelming number of people who must maintain confidence in the accuracy of the outcome of the election results. Mark my words, if the integrety of the voting system is in doubt the legitmacy of the Government itself comes into question.

Optical scanners are understandable to everyone, they have the bonus of paper back up and where ballot boxes can be stuffed scanners can be punched.

[Theyknow]

"The rest of the 'non-partisan' organizations are suspiciously located in California, some at universities, non-partisan California universities? Come on."

If California scientists found a cure for cancer would you turn it down because it was from a suspicious source? Like it or not some of the best scientists are located in California, particularly in the area of computer science.

---

"Votes cast for the Democratic candidate for governor in one precinct during last fall's gubernatorial race were credited to Jeb Bush because of a "misaligned" touch screen. No one knows how many votes were misrecorded. "

"They lost there credibility here. They don't know how many were "misrecorded', because they are not sure it really happened. This was an allegation, not a fact."

You are absolutely right that there is no fact here that can be proven. But that is the point exactly. There is no way to determine what, if anything, may have gone wrong once the voting is complete. Think of the potential for manipulation in places like Chicago when they figure this trick out.

[uncbuck]

I don't have a problem with California scientists, it's the statement that the university organizations are 'non-partisan'. Where is there a university, anywhere, but particularly in California, that is 'non-partisan'?
Have you looked at some of the 'non-partisan' tripe coming from ANY university Poli-sci, History or philosophy departments lately?

As for the example they give for it not working, my problem isn't wether the new machines worked, it's that it was Jeb Bush who got false votes. Yep, this article is 'non-partisan'.

Now, I agree that the system was put into place as a knee-jerk reaction to the events of Nov 2000, and that it may not have been developed enough and was forced into the system by the Democrats. The Dems cheat so much, that when it was as close as it turned out to be in Florida, they couldn't imagine how thier Gore lost when they 'fixed it' for him to win. I also think it was a waste of taxpayer moneies, better spent elsewhere, PARTICULARLY by the tax payer.

[Wonder Warthog]

A well-designed electronic system could overcome these weaknesses without adding new ones. Unfortunately, many electronic systems not only add new weaknesses, but they also fail to correct the problems of paper ballots."

I agree with Willie G. The best approach is optical scanning of paper ballots. It combines the best of both worlds (immediacy of result, "paper trail" in case of error). All-electronic voting is WAY to vulnerable to behind-the-scenes hacking.

[Wonder Warthog]

"Tell me how anyone could delete any votes from such a system without the alteration being obvious."

This places too much "trust" in the system designers, and can only be "checked" by computer gurus. Any auditor can check paper ballots.

[Theyknow]

"As for the example they give for it not working, my problem isn't wether the new machines worked, it's that it was Jeb Bush who got false votes. Yep, this article is 'non-partisan'."

We both know Jeb did not benefit from the touch screen system. That has nothing to do with my point. My bet is that they did a search on any search engine and that example is the only one that came up. This is very new and there have not been many opportunities for problems to come up yet. Who cares if it had to do with Jeb? No one took it seriously anyway. The problem is that we shouldn't wait until the Rats get a hold of this potential and run with it. When that happens and questions arise what will we do? Just because the only early example of how it could be done (NOT THAT IT WAS DONE) had to do with Jeb should not be reason to ignore the potential that it could ACTUALLY be done by the Rats. There are accurate automated systems which can also be counted manually if there is an issue, These new systems do not instill faith.

[6ppc]

The biggest problem I see with the untamperable electronic schemes is the infrastructure required to support them. Lots of equipment to create/read/validate the PROMS.

I've developed touchscreen systems, and miscalibration is a very real problem. With no printout to review prior to committing your vote it would be easy for a miscalibrated screen to register the wrong choice. Even with the printout, most folks would simply throw the slip away without looking at it.

Simplicity is the way to go.

Optical scanner is by far the best system. It requires the voter to actually read the ballot and mark their choice on the ballot. It also provides an audit trail as well as allowing for use of old fashioned ballot boxes if the machines break or there aren't enough machines to go around.

[afraidfortherepublic]

...future requirements for a tangible audit trail

Absolutly necessary!

[supercat]

Any auditor can check paper ballots.

How can any auditor ensure that they are genuine and have not been altered?

[supercat]

BTW, here's my mechanical voting system design; tell me how you like this one.

Votes for this machine would be recorded on 1/2" paper tapes which would be factory-punched with sprocket holes every 1/4" down one side. Each tape would be marked with a unique design (preferably identifying the race, candidate, district, ward, and machine) which repeated every 1/4" or 1/2" (lined up with the sprocket holes). There would be one tape for each candidate, plus one for each race for a write-in candidate, and one for each race for "no candidate selected". An additional tape would be used in any "vote for two" race to indicate that only one candidate was selected [two extras in vote-for-three or vote-for-four races].

Initially, the tapes would have no punches in them other than the sprocket holes. Before the election, each tape would be marked at the end to indicate the race, precinct, ward, and machine for which the tape would be used as well as the candidate the tape represents. It would be further signed and sealed by representatives of all interested parties. [One set of seals could be applied by a surely-trusted representative of each party who need not be present on-site and another set applied by on-site representatives].

To the extent possible, everything in the machine would be transparent except the enclosures holding the tape spools. Each tape would come out of an opaque enclosure, through a visible mechanism, and proceed into another opaque enclosure. After the voter selects candidates using pull-levers and pulls the "finish voting" lever, the visible mechanism would, in clear view of the voter, punch the appropriate tape for every selected office (or two tapes for vote-for-two offices) and advance the appropriate tapes by 1/4" (or 1/2", depending upon the design size).

If there are four inches of tape between the punching mechanism and the opaque takeup-spool enclosure, it would be necessary to prep the machine by punching each tape ten times after loading, to ensure that every voter saw punched tape from the puncher to the takeup spool; these ten punches would be figured in the tally below.

Once voting is complete, the tail end of each tape would be marked and sealed by appropriate party representatives and the tapes submitted for counting. Counting could be accomplished very quickly and easily, since each tape would simply have a uniform bunch of holes on it. Subtract ten from the number of holes to get the number of votes for the candidate represented by the tape.

The use of a "no candidate selected" tape would protect other tapes from alteration; if 2,500 people voted and there were six presidential candidates (plus "write-in" and "no-candidate-selected") then there should be exactly 2,580 non-sprocket holes in all the presidential tapes. Assuming the tape is designed so that patching holes is impossible, and assuming that the number of voters is logged immediately upon the close of the election, it would be difficult for anyone to perform fraud upon the tapes without detection.

Anyone like that as an approach? The mechanics might be a little bit complicated, but hopefully not too bad. I think it would give voters a unique ability to actually see their vote permanently and indelibly recorded, something which is lacking in other voting systems.

[Wonder Warthog]

"How can any auditor ensure that they are genuine and have not been altered?"

Easier than he can check on anything electronic. But the real answer is that forensic chemistry methods WILL allow such things to be ascertained. Fraud will still certainly be possible, but detection and prevention are far easier with a real "hard-copy" paper trail than with evanescent electrons.

[supercat]

but detection and prevention are far easier with a real "hard-copy" paper trail than with evanescent electrons.

Bipolar PROMS work by blowing very small metal fuses. A machine using bipolar PROMs may be x-rayed if needed to ensure that everything is as it should be.

[supercat]

But the real answer is that forensic chemistry methods WILL allow such things to be ascertained.

How? Ballots are not individually traceable, and the requirements of secret voting specifically require that they not be. How, then, do you prevent unscrupulous election officials from replacing legitimately-cast ballots with "properly-voted" ballots? Bear in mind that no voter has any way of ensuring that the ballot on which he actually voted is the same as the one that's counted "on his behalf".

I actually like the idea of a fully-visible mechanical voting machine, though I don't know if we still have the manufacturing abilities necessary to produce it at a reasonable price.

[Wonder Warthog]

"Bipolar PROMS work by blowing very small metal fuses. A machine using bipolar PROMs may be x-rayed if needed to ensure that everything is as it should be."

Counting paper ballots is a whole lot faster, simpler, and cheaper.

[Wonder Warthog]

"How? Ballots are not individually traceable, and the requirements of secret voting specifically require that they not be. How, then, do you prevent unscrupulous election officials from replacing legitimately-cast ballots with "properly-voted" ballots? Bear in mind that no voter has any way of ensuring that the ballot on which he actually voted is the same as the one that's counted "on his behalf"."

Uh, that is what poll and ballot counting observers are for. With the optical scanning process, the paper ballots are sucked into and stored in the SEALED scanning machine. That SEALED machine is only opened if there is a question necessitating a recount, and then the SEALED machine is opened in the prescence of witness from all interested parties and the paper ballots re-counted. You can't do ANY of that with "all-electronic" means.

As I said before, the combined "paper/electronic" system has the fewest problems and limitations of any of the systems I know about.