Should electronic voting machines have voter verified paper audit trails?
Rush Holt, U.S. Representative (D-NJ) introduced The Voter Confidence and Increased Accessibility Act H.R. 550 which would mandate a voter verified paper audit trail (VVPAT). His website's "Frequently Asked Questions" section (accessed May 4, 2006) about VVPAT and the proposed legislation stated:
"Anything that is electronic and internal to the voting system is subject to the same software glitches, bugs, irregularities and other security risks as the voting system itself. If the computer's software processed the incoming data (votes cast) incorrectly in the first instance, the fact that it then stores that incorrect data in more than one place or in more than one format provides no security benefit, and auditability benefit - that incorrect data would simply be repeated in all of the 'ballot images,' in the protective counter and elsewhere in the system...
Without an independent, voter-verified paper trail, it is impossible to discover almost any but the most egregious anomalies, accidental or intentional. A voter-verified paper audit trail would enable a complete audit of close or questionable elections, and more fundamentally, would give voters confidence that their votes are actually being recorded and counted as they intended."
Robert A. Brady, U.S. Representative (D-PA), in a May 16, 2007 Committee on House Administration report on the Voter Confidence and Accesibility Act of 2007, stated:
"In order to restore public confidence and ensure transparency in future elections, the law must be revised to require an independent paper copy of each vote—verified by the voter him or herself—to serve as a check on any electronic tallies reported by the voting machines. If a jurisdiction chooses an electronic system to tally votes, the vote of record—the ballot—must be tangible, not electronic."
Rebecca Mercuri, PhD, President of Notable Software, Inc., in her Feb. 23, 2004 pamphlet "Facts About Voter Verified Paper Ballots," wrote:
"All fully-electronic (touchscreen, DRE, Internet) voting systems are subject to the limitations and risks of computer technology. This includes the inability of examination, no matter how thorough, to detect the presence of hardware and/or software that could be used, deliberately or inadvertently, to alter election outcomes...
Democratic elections require independent verification that a) all balloting choices have been recorded as intended and b) vote totals have been reliably and indisputably created from the same material examined by the voters. A Voter Verified Paper Ballot (VVPB) provides an auditable way to assure voters that their ballots will be available to be counted...
Without VVPB there is no way to independently audit the election results. Equipment failures, configurations and programming errors have resulted in costly election recalls and disputes that could have been prevented with VVPB."
Peter Neumann, PhD, Principal Scientist at SRI Computer Science Lab in his June 15, 2004 testimony on electronic voting systems before the California Assembly Committee on Elections Reapportionment and Constitutional Amendments, stated:
"All-electronic direct-recording voting machines (DREs), in the absence of voter-verified audit trails (VVATs), provide no meaningful assurances that votes are correctly processed. Ideally, a VVAT is a human-readable medium such as paper that is also machine-readable, and forms the vote of record especially in cases of any disputes. From the perspective point of system security experts, vendor claims that VVATs are unnecessary are seriously disengenuous and contraindicated by past experience, for a variety of reasons such as the extremely weak criteria that are used for evaluation, the vendor insistence on proprietary code, an evaluation process that is proprietary and paid for by the vendors, pre- and post-election testing of equipment that generally fails to detect certain serious problems such as Trojan horses and unauthorized dynamic changes, and other clear evidence in recent elections that the claims are not justified...
Worse yet, vendors claim there is no need for the VVAT because there is no evidence of tampering. However, that completely avoids the main point: these machines allow no evidence of tampering precisely because there is no VVAT! What goes on inside the computer memories in completely inscrutable."
Dan S. Wallach, PhD, Associate Professor of Computer Science at Rice University, stated in his testimony before the Ohio Joint Committee on Ballot Security on Mar. 18, 2004:
"In a VVAT system, the correctness of the software no longer matters. Either it consistently produces paper ballots that match voters' intent, or it is taken out of service.
An important benefit of VVAT over paperless DRE systems is the ability to audit the election. VVAT paper ballots are collected and stored in traditional ballot boxes such that they can be counted to determine the final election tallies. Because they were printed by computers, they can be read by other computers using optical character recognition (OCR) tools. They can likewise be read by human, if for whatever reason the electronic counts are considered unreliable. The VVAT ballots may also contain cryptographic security measures, perhaps printed as a bar-code, to provide protection against ballot stuffing attacks.
Certainly, the notion of having independent records of important data is not an idea unique to voting. Our banking industry, despite all of their computers, generates huge amounts of paper. Every ATM prints a receipt for its transactions. Credit card transactions likewise generate paper receipts. Furthermore, banks send every customer a printed statement at the end of the month. The existence of these redundant records allows for inconsistencies and fraud, which occur on a regular basis, to be detected and corrected. VVAT provides this same level of assurance to our election systems."
Common Cause, in the section of its website dedicated to electronic voting machines (accessed July 24, 2007) stated:
"Every voter should have the opportunity to physically verify that his or her vote will be cast as directed by the voter. In order to insure this, every machine must incorporate or produce a paper ballot that the voter can view before finally casting his or her vote. For sight-disabled voters, a voice audit that reads the paper ballot should be employed to allow the voter to verify his or her vote. We feel that voter confidence is the cornerstone of free and fair elections. Too many questions surround the use of paperless voting machines. In addition, it is impossible to have a meaningful recount with a paperless machine. We believe that the ballot of record, used in all recounts and audits, should be the paper ballot that the voter verified."
Jerry Berkman, Former Programmer/Analyst at U.C. Berkeley, in July 19, 2007 email to ProCon.org, offered the following:
"A lot of people used to think this [paper trail] would solve the integrity problems with electronic voting machines (DREs). However, they are really poorly made, costly, and don't work as expected. As an example, in one election in Cayahoga County (Cleveland), over 10% of the paper trails were either lost of jammed or otherwise could not be used. And research has showed that most voters don't look at them. Also, research shows DREs with many more undervotes than optical scan... DREs with paper trails work so badly that I don't know anyone who favors them anymore. Some people say they'd rather have a DRE with a paper trail than a paperless DRE, but they also say they'd rather have optical scan than DRE with paper trail... So my answer is that DREs with or without paper trails should be banned."
Ted Selker, PhD, Director of the California Institute of Technology (Caltech) and Massachusetts Institute of Technology (MIT) Voting Technology Project, in his Apr. 2004 paper, "Security Vulnerabilities and Problems with VVPT," wrote:
"There are many different ways of disenfranchising a person using a voter-verified paper trail. First, people can be disenfranchised in all the normal ways. They can have registrations problems; they can have valid design problems, polling place problems, etc. Second, the paper trail can be lost, stolen, or added to. Third, the equipment can be designed or accidentally set up so it doesn't work, or it slowly changes itself. Finally intentional fraud can be widespread and created in software in such a way that it can be hidden from the voter and from the ballot worker on the day of election and not be remedied later. The final problem is that counting paper cannot be done at the accuracy level that electronic counting can be done. In this way, even if everything is performed correctly, the difficulty of counting the paper electronically will make it impossible to compare electronic outputs with the paper outputs in a way that can determine whether an accurate count has been achieved...
Furthermore, VVPT complicates...the setup, teardown, and operations of the ballot place. It complicates polling place procedures during the vote. It gives extra and difficult tasks for a person to do and increases the problems with the user experience and the user interface. It also increases the length of time of voting, which makes it, with more steps, easier to make mistakes."
Michael Shamos, PhD, JD, Distinguished Career Professor of Computer Science at Carnegie Mellon University, in his 2004 paper "Paper v. Electronic Voting Records - An Assessment," published in the Proceedings of the 14th ACM Conference on Computers, Freedom and Privacy, wrote:
"It is alleged that adding a so-called 'voter-verified paper trail' to a DRE machine will either permit tampering to be detected or at the very least will provide a reliable record of how each voter voted that can be used for a recount, even if the recount must be done by hand. This is incorrect... The [voter-verified] paper trail provides no assurance at all that her vote will ever be counted or will be counted correctly. The reason simply is that the paper trail itself become insecure at the moment of its creation.
First, if the machine cannot be trusted, which is the working hypothesis of paper trail proponents, then it cannot be trusted to deal with the paper trail safely. After the voter leaves the voting booth, it can mark her ballot as void and print a different one. The voter will have left the booth believing not only that her vote was cast and counted properly, but that will also be counted properly in any recount. None of these beliefs is correct.
One might argue that the inspection and testing of the machine would reveal such abjectly bad behavior, but the claim of DRE opponents is that no amount of inspection and testing is ever sufficient. If testing is adequate to reveal paper flaws, then it is adequate to uncover other faults in the machines."
Conny B. McCormack, Los Angeles County Registrar-Recorder/County Clerk, stated in testimony before the U.S. Senate Committee on Rules and Administration on June 21, 2005:
"Adding another federal requirement for Direct Recording Electronic (DRE) voting systems to be retrofitted with a voter verified paper audit trail (VVPAT) component invites a number of problems that could, unintentionally, shatter the system and significantly erode public confidence in the process...The fact is that existing DRE systems without VVPAT have the proven track record of doing the best job of all available voting systems in achieving the goal of accurate casting, tabulation and reporting of all votes in accordance with the voters' intentions...
This debate also needs to recognize practical considerations including significant costs, paper jams and malfunctioning printers, voter delays, difficulty for poll workers, and meaningless receipts. If DRE programming can be manipulated, that same logic dictates that the programming could be surreptitiously altered to change election results after the paper ballot is printed."
Kay Maxwell, President of the League of Women Voters of the United States, in her testimony before the U.S. Election Assistance Commission on May 5, 2004 stated:
"For the VVPT system to work as a backup for counting the vote accurately, it seems that every voter must verify every ballot... But this is a very tall order. Setting up reliable means for voters to verify, or, more importantly, refuse to verify, their ballots at the polling place adds a significant burden at the polling place...
Even with paper records that are actually voter verified, there are significant remaining questions. There are questions about the accuracy, reliability and fraud-potential for the counting of paper records, with the long history of lost, mangled and manipulated paper ballots...
If a malicious programmer or an outside 'hacker' can change the electronic record of the vote, certainly such a skilled person can make the printer provide a paper record that doesn't expose any error... Under this scenario, the voter and the poll worker are not alerted to the problem. So, in this example, the paper does not indicate a problem with the machine, and does not provide a safeguard."
Election Technology Council's Oct. 2005 "Frequently Asked Questions" section on its website stated:
"Printing voter verifiable ballots adds several layers of cost and complexity to the process, accompanied by increased risk of failure at the polling place and the associated stress placed on poll workers... Even the simplest issues must be thoroughly addressed. For instance, a lengthy set of ballot options would require a lengthy receipt for voters.
The voting process could be 'intentionally' disrupted by voters who claim the paper receipt does not match how they voted, thereby putting the entire voting process in question. The time required to vote and verify a paper ballot will likely increase the amount of time a voter spends in the a voting booth, requiring more voting systems and increasing costs."