Kim Alexander, president, California Voter Foundation
The November election is fast approaching, and all over the country people are wondering if the results produced by paperless, electronic voting machines will be reliable.
The good news is that many jurisdictions have chosen to stick with paper voting systems rather than purchasing e-voting machines. After the 2000 election, many were predicting that by now half the nation would be voting on paperless e-voting machines. Instead, the rate is about 25 percent. The majority of election officials have stuck with transparent and verifiable voting systems. Several have demonstrated strong leadership to advance voting system security:
In Nevada, Secretary of State Dean Heller is implementing Sequoia touchscreens with a voter verified paper record, to be unveiled in Las Vegas on August 28. See the Secretary of State's announcement for more details. (FYI, I'll be attending and reporting on this demonstration). Nevada is the first state in the nation to implement a voter verified paper trail for a presidential election, and is the third jurisdiction in the country, following Sacramento, CA in 2002 and Southington, CT in 2003 to have voters cast electronic ballots backed up with a voter verified paper record in a binding, public election.
In Indiana, Johnson County has decided to put their ES&S touchscreens away and use a paper voting system instead this November. County Clerk Jill Jackson said using a paper system was "the safest and surest thing to do." Johnson County made this decision after they learned that ES&S had installed uncertified software in their voting systems. The county gave ES&S a deadline to get their software certified, and ES&S failed to meet the deadline. (For more on this story see my Aug. 23 blog.)
In Ohio, where a paper trail will be required in 2006, Secretary of State Ken Blackwell announced on July 16 that no counties would be purchasing new equipment prior to November. "I will not place these voting devices before Ohio's voters until identified risks are corrected," Blackwell said. Instead of there being possibly 36 counties in Ohio using e-voting machines, there are now five.
In California, Secretary of State Kevin Shelley banned Diebold's TSx voting machine, requiring four California counties -- San Diego, Kern, San Joaquin and Solano -- to use paper-voting systems instead. He is also requiring the ten counties that use paperless e-voting machines to give voters the option to vote on paper if they choose, and that the vendors' source code be provided to his office for review. (A list of these 23 requirements is available online.)
The bad news is that paperless, electronic voting systems will be used in many jurisdictions throughout the country, including in several key presidential election "swing states", such as Pennsylvania, North Carolina, Florida, New Mexico, Louisiana and Tennessee.
There have been a number of recommendations made in recent weeks to improve election security in advance of the November election. The Election Assistance Commission issued a "Best Practices" toolkit, online. The Brennan Center for Justice and the Leadership Conference on Civil Rights also recently issued a report proposing numerous reforms to improve election security.
The California Voter Foundation has a new set of recommendations to add to the mix. "Ten Things Election Officials Can Do To Secure The Vote This November" is a new CVF publication.
These ten steps, while no replacement for the voter-verified paper trail, will, if implemented help reduce real and perceived paperless e-voting risks.
1) "Paper or Plastic?" option
Give voters in electronic voting jurisdictions the choice of casting a paper ballot in their polling place if they prefer to do so. Every polling place should have an ample supply of paper ballots available in case the voting equipment fails. An "ample supply" would be a supply of paper ballots equivalent to at least 25 percent of a jurisdiction's registered voters.
2) Paper, not electronic provisional voting
Federal law now requires pollworkers to allow voters whose names don't appear on the voter list to cast a provisional ballot. Provisional ballots are counted after the polls close. To protect a voter's ballot secrecy, a paper provisional ballot is placed inside an envelope that bears the provisional voter's name on the outside of the envelope. After election officials determine whether the voter's ballot should be counted, the paper ballot is separated from the envelope and is counted. In this way, a provisional voter's status can be verified without violating that voter's right to cast a secret ballot.
Electronic provisional balloting, which has already been implemented in some jurisdictions, places the voter's right to ballot secrecy at risk, since adequate privacy or security measures typically have not yet been developed to ensure that the voter's right to cast a secret ballot is protected in an electronic environment. For both security and voter privacy reasons, electronic provisional balloting should be prohibited.
3) Access to source code by election officials
Election officials should have the right to inspect any source code being used in their voting system. This reform has been endorsed by DeForest Soaries, chairman of the federal Election Assistance Commission.
4) Paper audit trail summary results
Many voting machines can print a paper summary at the close of polls of all the votes cast throughout the voting day. These paper audit trails should be used to verify that the results reported at polling places are accurately reflected in the final election results. These audit trails should also be posted outside of polling places at the close of polls. In places using machines that cannot produce a printed report, pollworkers should be given charts of the races and measures on the ballot in that precinct to be filled in, with one returned to the election office and another posted outside the polling place at the close of polls.
5) Public reconciliation of results
The verification process described above should be performed in public. The number of voters checking in at each polling place should also be publicly compared to the number of ballots recorded and counted from each polling place. Such proceedings should be open to videotaping and properly noticed to the public.
6) Public posting of equipment and procedures
The security procedures that will be followed before, during and after the election should be publicly posted, on the Internet and/or in local election offices. Procedures should be set and published no less than 45 days in advance of Election Day. All jurisdictions should disclose the vendor, equipment name and model number, and all software and firmware version numbers of their voting equipment to the public online and/or in election offices and at polling places. Contracts with voting equipment vendors should also be made readily accessible to the public.
7) Federal and state equipment approval
All voting equipment used should be fully tested and certified by state and federal authorities. All states should conduct an inventory of their equipment hardware and software to verify that what they are using has been approved by the proper oversight authorities. All equipment should be approved at least 45 days prior to Election Day.
In addition, as recommended in the EAC's Best Practices, last-minute changes and software patches that have not been tested, qualified and certified should be prohibited.
8) Chain of custody of equipment and software
It is up to states and local jurisdictions to ensure that the
versions of software and firmware used in electronic voting machines, peripheral devices (such as smart card encoders) and vote tabulation servers are the versions that have been state certified and/or federally qualified. Election officials must also ensure that any voting equipment or device that stores electronic ballots is protected at all times. Voting equipment left in insecure locations before and after the election undermines voter confidence in election security. Voting equipment should be sealed in a secure manner before and after the election. The seal used for this purpose should be one that is less easily tampered with than the typical plastic "seals" used on voting machines. Election officials must develop procedures that describe how equipment will be securely delivered and retrieved from polling places in a timely fashion, as well as how machines will be warehoused and protected before and after the election.
9) Security plan for every jurisdiction
Security plans for all aspects of the voting process should be drawn up and published at least 45 days prior to the election. These security plans should include a communications plan for polling places to ensure pollworkers have access to a phone, and an environmental plan to ensure polling places are equipped with ample electricity and lighting and are wheelchair-accessible. All tasks associated with administering electronic voting equipment should be overseen by election officials. Critical tasks such as training pollworkers, programming machines, delivering equipment, and tabulating results on Election Night should be managed by the elections department and not outsourced to the vendor.
10) Truly "stand-alone" systems
Any electronic voting equipment that is used in polling places or at the local election office to tabulate results must truly be "stand-alone" devices. No modems, modem ports, wireless devices, or wireless ports should be available for use with any electronic voting equipment. Any communication ports on voting devices should be disabled. Computer equipment used to tabulate results should not be connected to the Internet.
Reprinted with permission from the California Voter Foundation.
