Accessibility and Auditability In Electronic Voting

ABSTRACT

Nearly one-third of American voters - over 50 million people - live in districts that will use electronic voting (e-voting) terminals to elect the next president. In contrast, less than half that number cast an electronic ballot in 2000. This huge increase in e-voting has been embraced by the disability rights community, as these systems could make it possible for many disabled Americans to cast their ballots in secret, without the assistance of another person.

However, widespread reports of voting terminal failures, and growing concern about the of these machines security, are fueling fierce debate over how to ensure the integrity of our elections. The particular concern about direct recording electronic (DRE) voting terminals is that they can provide no real audit, and their capacity for a recount is essentially nonexistent. If the integrity of a race is called into question, election officials have no recourse but to trust the machine. This article examines the dual issues of accessibility and auditability, and sets forth the premise that accessible elections with verifiable results are not an impossibility. In fact, currently available technology can accomplish both objectives.

BACKGROUND

Nearly one-third of American voters - over 50 million people - live in districts that will use electronic voting (e-voting) terminals to elect the next president ("New Study," 2004). In contrast, less than half that number cast an electronic ballot in 2000. This huge increase in e-voting has been embraced by the disability rights community, as these systems could make it possible for many disabled Americans to cast their ballots in secret, without the assistance of another person.

However, widespread reports of voting terminal failures (see, e.g., Novak, 2004), and growing concern about the of these machines security (Kohno et al, 2003; "Trusted agent," 2004; Risk assessment," 2003), are fueling fierce debate over how to ensure the integrity of our elections. The particular concern about direct recording electronic (DRE) voting terminals is that they can provide no real audit, and their capacity for a recount is essentially nonexistent. If the integrity of a race is called into question, election officials have no recourse but to trust the machine. An important part of this discussion, therefore, has focused on whether and when to equip direct recording electronic (DRE) voting terminals with a voter-verifiable paper audit trail (VVPAT) (Mercuri, 2002).

A VVPAT solves this problem by adding a second record of each vote. Upon completing his/her selections, a voter is presented with a summary both on screen and on a paper printout. If the two records match, both are retained by the machine in the event of a recount. If they do not match, the voter can alert an election official that the machine is malfunctioning. The nation's leading security experts ("Resolution," 2004) and a growing popular movement champion the VVPAT, although it is by no means the only possible solution.

As a result, America is rethinking electronic voting. Seven states now have directives or laws requiring VVPAT, and 14 others have introduced similar legislation ("Election reform," 2004). Federal legislators are considering reforms that would mandate a VVPAT for DREs (see, e.g., Holt, 2003). In some election jurisdictions, officials have deferred multi-million dollar DRE purchases (Garvin, 2003) while others are upgrading to non-DRE voting systems.

The prospect of complications or delay in DRE deployment has alarmed some members of the disability rights community. That alarm has been fueled by two myths: 1) that VVPAT-enabled DREs do not exist and 2) that only DREs can provide accessible voting to people with disabilities. For example, the American Association for People with Disabilities' (AAPD) website states, "Touch screen voting systems that provide a [VVPAT] do not exist, have not been tested in the real world, and are not certified" ("AAPD policy," 2003). Further, a lawsuit filed on behalf of AAPD and others claims that "only DRE systems, when properly equipped, are accessible and enable voters who are disabled to vote independently, unassisted and in secret" ("AAPD v. Shelley," 2004). If taken at face value, these statements imply that the push toward verifiable elections must pull us away from accessible elections.

But accessible elections with verifiable results are not an impossibility. In fact, currently available technology can accomplish both objectives. Accessible, auditable, federally qualified machines are available for purchase today, and more are scheduled for release in the coming months. Further, non-DRE methods of accessible voting are also available and in development.

OPTIONS FOR AUDITABLE AND ACCESSIBLE VOTING

Before discussing "accessible" voting options, it is important to note the limitations of that term in this context. There are currently no federal standards that set performance levels for accessibility, and only the most anecdotal studies have been conducted. However, all of the following technologies attempt to serve disabled voters by some combination of audio interfaces, high-contrast displays, adjustability for wheelchair users, sip/puff interfaces, and other accessibility features. This is not a discussion of how well or poorly a particular solution is implemented; it is simply a starting point for further investigation.

ACCESSIBLE ALTERNATIVES TO DRES

The controversy over DREs has distracted the public from the availability of other accessible, auditable voting technologies. Optical scan systems are the most widely used voting technology in the country, and they can be made accessible with both high- and low-tech solutions.

1. Tactile ballot templates ("Best practices") for optical scan ballots can be used, in conjunction with an audio interface, to aid the blind and non-English speakers in casting ballots without assistance and in secret. This technology is used throughout Rhode Island, costs very little, and has been positively reviewed by AAPD's Jim Dickson, one of the accessible voting community's most outspoken advocates (Dickson, 2001). Also, it does not require voters to know Braille.

2. Electronic ballot markers can be used to fill out optical scan ballots. These systems look like traditional DREs, but they record votes on paper ballots instead of internal memory. This kind of machine can match all of a DRE's accessibility features (audio interface, sip/puff input, multiple languages, etc.), and every vote can be verified before submission:

a. Avante's Optical Vote-Trakker is a federally qualified, accessible, electronic ballot-marking system. It was the first system qualified to the FEC's 2002 voting standards, a designation that means, in part, that it produces a 0% error rate even after 1.5 million votes ("First true," 2004). Certification is pending in several states.

b. ES&S, the nation's second-largest voting equipment manufacturer, is also in the process of attaining federal qualification for an electronic ballot marking system. It will be available later this year ("New ballot," 2004)

DRES WITH VOTER-VERIFIED PAPER AUDIT TRAILS

DREs equipped with a VVPAT can also provide auditable, accessible voting:

a. Avante's Vote-Trakker is an accessible, VVPAT-equipped DRE that has completed federal testing. It is certified for use in several states and has certifications pending in others ("The Tally," 2003). This system has been used successfully in five separate elections and the American Council of the Blind lists the Vote-Trakker as an accessible voting system ("Accessible voting," 2001). In addition, Jim Dickson of AAPD has called Avante's VVPAT an "elegant way" to provide a paper audit trail if one is mandated (Chung, 2004).

b. AccuPoll produces a federally qualified, accessible, VVPAT-equipped DRE system ("Accupoll receives," 2004). The company is actively pursuing state contracts and expects to have equipment in the field for the November 2004 election. The American Council for the Blind lists AccuPoll as an accessible voting system manufacturer ("Accessible voting," 2001).

c. Sequoia Voting Systems, the country's third-largest election equipment manufacturer, produces a VVPAT-equipped AVC Edge ("Marketing materials"). The unit will be deployed in every Nevada election jurisdiction in time for the 2004 presidential election ("Sequoia voting," 2003).

d. TruVote is in the process of qualifying a VVPAT-equipped DRE. The system also allows voters to verify that their vote was part of the final vote tally via a post-election web interface. The TruVote system should be qualified and available for purchase in 2004.

ADOPTING THESE SOLUTIONS

Unfortunately, the existence of accessible, auditable equipment does not guarantee that it will be considered for purchase. Certification hurdles and election official education must also be addressed.

1. Certification Hurdles - The U.S. has a patchwork of different certification requirements, and sometimes these requirements are all that stands between a federally certified voting machine and a market. Where possible, we hope that states will expedite their certification processes to allow the procurement of auditable, accessible machines. This is especially important in states where counties are still trying to purchase new systems before the November election.

2. Election Official Education - Some election officials have inadequate market knowledge and are therefore unable to make informed decisions about voting machines. For example, Colorado Secretary of State Donetta Davidson has publicly claimed, "To date, there has not been a single voter-verifiable voting system tested or certified at either a national or state level" (Klammer, 2004). Neither part of this statement is true, and it precludes Colorado from making an informed procurement choice. All of those concerned about elections, whether focused on accessibility or security, should address these kinds of misconceptions.

JURISDICTIONS THAT ALREADY HAVE DRES

Some counties have already purchased paperless DREs, and replacing those machines with one of the systems described above before the November election would be impossible. In those cases, we could get closer to the goal of accessible elections with verifiable results if additional safeguards are adopted. California Secretary of State Kevin Shelley has outlined such a plan, mandating that counties be allowed to use already-purchased DREs under two conditions: DREs must either be equipped with a VVPAT or meet 23 additional security requirements, and voters must be allowed to vote on a paper ballot if they so desire (Shelley, 2004). This stopgap solution preserves accessibility for disabled voters and increases election integrity.

It is now clear that DREs have serious problems, many of which stem from inadequate testing procedures or the failure to follow those procedures. At a minimum, every DRE voting technology should be subjected to public "red team" testing, should use only certified election code, and should provide voters with paper ballots upon request.

1. Certified Code - Software used in elections is required by law to be certified and verified, then held in escrow by election officials who can audit its installation. However, voting machine vendors have repeatedly violated that law, sometimes with the knowledge of election officials, by installing uncertified software on DREs used in real elections (Hoffman & Reiterman, 2003; Halvorson & McKnown, 2004) This not only introduces unknown code, it also undermines the ability of election officials to use escrowed code to determine if tampering has occurred. Robust performance and security rely on addressing known problems and minimizing unknown threats; failure to follow these basic legal requirements puts our elections at risk.

2. Red Team Testing - Federal and state certification processes do not currently include time-limited simulations where professionals attempt to subvert a mock election, also known as "red team" attacks. This kind of testing is extremely valuable because it clearly illustrates vulnerabilities while providing a blueprint to correct them. To date, only one red team attack has been conducted with a real voting machine, and it exposed serious problems ("Trusted agent," 2004). All DREs should be subjected to this kind of testing, and subsequent recommendations should be made public and then adopted.

3. Paper Backups - In addition to these steps, election jurisdictions should prepare to provide voters with paper ballots upon request. Every state has procedures for absentee and provisional balloting, and those procedures should be extended to voters who choose not to use a DRE that cannot be audited.

THE ROAD AHEAD

American election reform remains a process of years, not months. However, we believe that there are immediately available and ever-increasing options for promoting accessibility and integrity in our elections. The technologies outlined above must still be rigorously tested and widely deployed, but their existence will hopefully provide common ground where the disability rights and security communities can plan the next wave of improvements to the way that we vote.

SUMMARY

Recent exposure of problems in electronic voting systems has led to widespread calls for a voter-verified paper audit trail (VVPAT). However, some claim that accessible, auditable voting systems do not exist and that the public must choose between the rights of disabled voters and verifiable elections. We reject this false choice. Accessible, auditable voting systems have been nationally qualified and can be purchased today. Even more will be available in the coming months. We instead call for cooperation in the ongoing effort to improve accessibility and auditability in election technology.

REFERENCES

AAPD policy statement on voter verified paper ballots (2003). Retrieved May, 2004, from http://www.aapd.com/dvpmain/elreform/aapdballots.html

AAPD v. Shelley (2004). C.D. Cal.

Accessible voting fact sheet (2001). Retrieved May, 2004, from http://web.archive.org/web/20020816072511/http://acb.org/washington/accessible-fact02.html

Accupoll received federal qualification for electronic voting system (2004, March 26). Retrieved May, 2004, from http://www.accupoll.com/News/PressReleases/2004-03-26.html

Best practices: ballot templates. Retrieved May, 2004, from http://www.electionaccess.org/Bp/Ballot_Templates.htm

Chung, K. (2004). Testimony before CA Voting Systems and Procedures Panel, April 22-24, 2004. Retrieved May, 2004, from http://tinyurl.com/yrmj8

Dickson, J. Not-so-secret ballot (2001). Retrieved May, 2004 from http://www.electionaccess.org/publications/ET2001/02_01_Dickson.htm

Election reform briefing: securing the vote (April 30, 2004). Retrieved May, 2004, from http://www.electionline.org/site/docs/pdf/EB7_new.pdf

First true pixel-based optical Mark-Sense voting system achieved 0% error rate in 1.5 million votes. Retrieved May, 2004, from http://www.aitechnology.com/votetrakker2/Optical%20Vote-Trakker%20Press%20Release.PDF

Garvin, C. (2003, June 5). The paper chase: county leaders postpone a bid for digital democracy amid fears of vote tampering. Sacramento News & Review. Retrieved May, 2004, from http://www.newsreview.com/issues/sacto/2003-06-05/news.asp

Halvorson, E. & McKnown, L.S. (2004, March 15). Johnson County demands answers from ES&S. WISHTV Indianapolis. Retrieved May, 2004, from http://www.wishtv.com/Global/story.asp?S=1712213&nav=0Ra7LXSW

Hoffman, A. & Reiterman, T. (2003, November 13). Secretary of State orders audit of all counties' voting systems. Los Angeles Times, pp. B.8.

H.R. 2239 (2003). Retrieved May, 2004, from http://holt.house.gov/display2.cfm?id=6282&type=Home

Klammer, P. (2004, April 11). Speakout: too much doubt about e-voting. Rocky Mountain News. Retrieved May, 2004, from http://www.rockymountainnews.com/drmn/opinion/article/0,1299,DRMN_38_2793358,0 0.html

Kohno, T., Stubblefield, A., Rubin, A.D. & Wallach, D.S. (2003, July 23). Johns Hopkins University Information Security Institute Technical Report TR-2003-19. Retrieved May, 2004, from http://avirubin.com/vote/

Marketing materials for Sequoia's AVC Edge. Retrieved May, 2004, from http://www.sequoiavote.com/productguide.php

Mercuri, R. (2002, October). A better ballot box? IEEE SPECTRUM, Volume 39, Number 10. Retrieved May, 2004, from http://www.notablesoftware.com/Papers/1002evot.pdf

New ballot marking device from ES&S, Automark makes optical scan voting accessible to voters with disabilities (2004, April 1). Retrieved May, 2004, from http://www.essvote.com/index.php?section=press_item&press_id=84

New study shows 50 million voters will use electronic voting. (2004, February 12). Retrieved May, 2004, from http://www.electiondataservices.com/EDSInc_VEstudy2004.pdf

Novak, V. (2004, April 26). The vexations of voting machines. CNN.com: Inside Politics. Retrieved May, 2004, from
http://www.cnn.com/2004/ALLPOLITICS/04/26/votingmachines.tm/

Resolution on electronic voting (2004). Retrieved May, 2004, from http://www.verifiedvoting.org/resolution.asp

Risk assessment report: Diebold Accuvote-TS voting system and processes (2003, September 2). Retrieved May, 2004, from http://www.dbm.maryland.gov/dbm_search/technology/toc_voting_system_report/voting systemreportfinal.pdf

Sequoia Voting Systems selected to provide uniform statewide electronic voting system for Nevada (2003). Retrieved May, 2004, from http://www.sequoiavote.com/article.php?id=55

Shelley, K. (2004, April 30). Decertification and withdrawal of approval of certain DRE voting systems and conditional approval of the use of certain DRE voting systems. Retrieved May, 2004 from
http://www.ss.ca.gov/elections/ks_dre_papers/decert1.pdf

The Tally (2003, April/May). Retrieved May, 2004, from http://www.aitechnology.com/votetrakker2/News%20Releases/April%20May%202003% 20Tally.pdf

Trusted agent report: Diebold Accuvote-TS voting system (2004, January 20). Retrieved May, 2004, from http://www.raba.com/press/TA_Report_AccuVote.pdf

Vote-Trakker product overview. Retrieved May, 2004, from http://www.aitechnology.com/votetrakker2/overview.html