Should Electronic Voting Machines Have Voter Verified Paper Audit Trails?
General Reference (not clearly pro or con)
The National Academy of Science’s 2005 report “Asking the Right Questions About Electronic Voting” included the following description:
“A ‘voter verified paper audit trail’ (VVPAT) consists of physical paper records of voter ballots as voters have cast them on an electronic voting system. In the event that an election recount or audit is called for, the VVPAT provides a supporting record. The ‘voter-verified’ part of the VVPAT refers to the fact that the voter is given the opportunity to verify that the choices indicated on the paper record correspond to the choices that the voter has made in casting the ballot. Thus, the result of an election is an electronic tally of the votes cast and a paper record of the individual votes that have been cast.”2005
The State of Texas Election Division, Legal Section delivered a letter to the State of Texas Director of Elections, Ann McGeehan, on Feb. 21, 2006 regarding Diebold’s AccuVote TSX electronic voting system which includes a printer module for voter verifiable paper audit trails. The letter provided the following description:
“The printer produces a voter verifiable paper audit trail in that the choices a voter selects on the DRE [direct recording electronic voting machine] are printed on the tape for the voter’s review before the electronic ballot is recorded. If, after reviewing the tape, the voter decides that they match and casts the electronic ballot, the tape is rolled up into the printer’s housing. If the voter determines that the tape does not match the selections on the DRE, the paper tape is marked as spoiled and the voter may make changes or vote again on the DRE. The voter does not have access to the tape, which is enclosed in a clear housing window for review.”Feb. 21, 2006
Rebecca Mercuri, PhD, President of Notable Software, Inc., in her Oct. 2002 IEEE Spectrum paper “A Better Ballot Box?” offered this explanation:
“A voter-verified physical audit trail…requires that the voting system print a paper ballot containing the selections made on the computer. This ballot is then examined for correctness by the voter through a glass or screen, and deposited mechanically into a ballot box, eliminating the chance of accidental removal from the premises. If, for some reason, the paper does not match the intended choices on the computer, a poll worker can be shown the problem, the ballot can be voided, and another opportunity to vote provided.”Oct. 2002
Bruce Schneier, PhD, Founder and Chief Technical Officer at Counterpane Internet Security, Inc., wrote a Nov. 10, 2004 article titled “The Problem with Electronic Voting Machines,” which stated:
“A voter-verified physical audit trail…requires that the voting system print a paper ballot containing the selections made on the computer. This ballot is then examined for correctness by the voter through a glass or screen, and deposited mechanically into a ballot box, eliminating the chance of accidental removal from the premises. If, for some reason, the paper does not match the intended choices on the computer, a poll worker can be shown the problem, the ballot can be voided, and another opportunity to vote provided.”Nov. 10, 2004
Rush Holt, U.S. Representative (D-NJ) introduced The Voter Confidence and Increased Accessibility Act H.R. 550 which would mandate a voter verified paper audit trail (VVPAT). His website’s “Frequently Asked Questions” section (accessed May 4, 2006) about VVPAT and the proposed legislation stated:
“Anything that is electronic and internal to the voting system is subject to the same software glitches, bugs, irregularities and other security risks as the voting system itself. If the computer’s software processed the incoming data (votes cast) incorrectly in the first instance, the fact that it then stores that incorrect data in more than one place or in more than one format provides no security benefit, and auditability benefit – that incorrect data would simply be repeated in all of the ‘ballot images,’ in the protective counter and elsewhere in the system…
Without an independent, voter-verified paper trail, it is impossible to discover almost any but the most egregious anomalies, accidental or intentional. A voter-verified paper audit trail would enable a complete audit of close or questionable elections, and more fundamentally, would give voters confidence that their votes are actually being recorded and counted as they intended.”May 4, 2006
Robert A. Brady, U.S. Representative (D-PA), in a May 16, 2007 Committee on House Administration report on the Voter Confidence and Accesibility Act of 2007, stated:
“In order to restore public confidence and ensure transparency in future elections, the law must be revised to require an independent paper copy of each vote—verified by the voter him or herself—to serve as a check on any electronic tallies reported by the voting machines. If a jurisdiction chooses an electronic system to tally votes, the vote of record—the ballot—must be tangible, not electronic.”May 16, 2007
Rebecca Mercuri, PhD, President of Notable Software, Inc., in her Feb. 23, 2004 pamphlet “Facts About Voter Verified Paper Ballots,” wrote:
“All fully-electronic (touchscreen, DRE, Internet) voting systems are subject to the limitations and risks of computer technology. This includes the inability of examination, no matter how thorough, to detect the presence of hardware and/or software that could be used, deliberately or inadvertently, to alter election outcomes…
Democratic elections require independent verification that a) all balloting choices have been recorded as intended and b) vote totals have been reliably and indisputably created from the same material examined by the voters. A Voter Verified Paper Ballot (VVPB) provides an auditable way to assure voters that their ballots will be available to be counted…
Without VVPB there is no way to independently audit the election results. Equipment failures, configurations and programming errors have resulted in costly election recalls and disputes that could have been prevented with VVPB.”Feb. 23, 2004
Peter Neumann, PhD, Principal Scientist at SRI Computer Science Lab in his June 15, 2004 testimony on electronic voting systems before the California Assembly Committee on Elections Reapportionment and Constitutional Amendments, stated:
“All-electronic direct-recording voting machines (DREs), in the absence of voter-verified audit trails (VVATs), provide no meaningful assurances that votes are correctly processed. Ideally, a VVAT is a human-readable medium such as paper that is also machine-readable, and forms the vote of record especially in cases of any disputes. From the perspective point of system security experts, vendor claims that VVATs are unnecessary are seriously disingenuous and contraindicated by past experience, for a variety of reasons such as the extremely weak criteria that are used for evaluation, the vendor insistence on proprietary code, an evaluation process that is proprietary and paid for by the vendors, pre- and post-election testing of equipment that generally fails to detect certain serious problems such as Trojan horses and unauthorized dynamic changes, and other clear evidence in recent elections that the claims are not justified…
Worse yet, vendors claim there is no need for the VVAT because there is no evidence of tampering. However, that completely avoids the main point: these machines allow no evidence of tampering precisely because there is no VVAT! What goes on inside the computer memories is completely inscrutable.”June 15, 2004
Dan S. Wallach, PhD, Associate Professor of Computer Science at Rice University, stated in his testimony before the Ohio Joint Committee on Ballot Security, on Mar. 18, 2004:
“In a VVAT system, the correctness of the software no longer matters. Either it consistently produces paper ballots that match voters’ intent, or it is taken out of service.
An important benefit of VVAT over paperless DRE systems is the ability to audit the election. VVAT paper ballots are collected and stored in traditional ballot boxes such that they can be counted to determine the final election tallies. Because they were printed by computers, they can be read by other computers using optical character recognition (OCR) tools. They can likewise be read by human, if for whatever reason the electronic counts are considered unreliable. The VVAT ballots may also contain cryptographic security measures, perhaps printed as a bar-code, to provide protection against ballot stuffing attacks.
Certainly, the notion of having independent records of important data is not an idea unique to voting. Our banking industry, despite all of their computers, generates huge amounts of paper. Every ATM prints a receipt for its transactions. Credit card transactions likewise generate paper receipts. Furthermore, banks send every customer a printed statement at the end of the month. The existence of these redundant records allows for inconsistencies and fraud, which occur on a regular basis, to be detected and corrected. VVAT provides this same level of assurance to our election systems.”Mar. 18, 2004
Common Cause, in the section of its website dedicated to electronic voting machines (accessed July 24, 2007), stated:
“Every voter should have the opportunity to physically verify that his or her vote will be cast as directed by the voter. In order to insure this, every machine must incorporate or produce a paper ballot that the voter can view before finally casting his or her vote. For sight-disabled voters, a voice audit that reads the paper ballot should be employed to allow the voter to verify his or her vote. We feel that voter confidence is the cornerstone of free and fair elections. Too many questions surround the use of paperless voting machines. In addition, it is impossible to have a meaningful recount with a paperless machine. We believe that the ballot of record, used in all recounts and audits, should be the paper ballot that the voter verified.”July 24, 2007
Jerry Berkman, Former Programmer/Analyst at U.C. Berkeley, in July 19, 2007 email to ProCon.org, offered the following:
“A lot of people used to think this [paper trail] would solve the integrity problems with electronic voting machines (DREs). However, they are really poorly made, costly, and don’t work as expected. As an example, in one election in Cayahoga County (Cleveland), over 10% of the paper trails were either lost of jammed or otherwise could not be used. And research has showed that most voters don’t look at them. Also, research shows DREs with many more undervotes than optical scan… DREs with paper trails work so badly that I don’t know anyone who favors them anymore. Some people say they’d rather have a DRE with a paper trail than a paperless DRE, but they also say they’d rather have optical scan than DRE with paper trail… So my answer is that DREs with or without paper trails should be banned.”July 19, 2007
Ted Selker, PhD, Director of the California Institute of Technology (Caltech) and Massachusetts Institute of Technology (MIT) Voting Technology Project, in his Apr. 2004 paper, “Security Vulnerabilities and Problems with VVPT,” wrote:
“There are many different ways of disenfranchising a person using a voter-verified paper trail. First, people can be disenfranchised in all the normal ways. They can have registrations problems; they can have valid design problems, polling place problems, etc. Second, the paper trail can be lost, stolen, or added to. Third, the equipment can be designed or accidentally set up so it doesn’t work, or it slowly changes itself. Finally intentional fraud can be widespread and created in software in such a way that it can be hidden from the voter and from the ballot worker on the day of election and not be remedied later. The final problem is that counting paper cannot be done at the accuracy level that electronic counting can be done. In this way, even if everything is performed correctly, the difficulty of counting the paper electronically will make it impossible to compare electronic outputs with the paper outputs in a way that can determine whether an accurate count has been achieved…
Furthermore, VVPT complicates…the setup, teardown, and operations of the ballot place. It complicates polling place procedures during the vote. It gives extra and difficult tasks for a person to do and increases the problems with the user experience and the user interface. It also increases the length of time of voting, which makes it, with more steps, easier to make mistakes.”Apr. 2004
Michael Shamos, PhD, JD, Distinguished Career Professor of Computer Science at Carnegie Mellon University, in his 2004 paper “Paper v. Electronic Voting Records – An Assessment,” published in the Proceedings of the 14th ACM Conference on Computers, Freedom and Privacy, wrote:
“It is alleged that adding a so-called ‘voter-verified paper trail’ to a DRE machine will either permit tampering to be detected or at the very least will provide a reliable record of how each voter voted that can be used for a recount, even if the recount must be done by hand. This is incorrect… The [voter-verified] paper trail provides no assurance at all that her vote will ever be counted or will be counted correctly. The reason simply is that the paper trail itself become insecure at the moment of its creation.
First, if the machine cannot be trusted, which is the working hypothesis of paper trail proponents, then it cannot be trusted to deal with the paper trail safely. After the voter leaves the voting booth, it can mark her ballot as void and print a different one. The voter will have left the booth believing not only that her vote was cast and counted properly, but that will also be counted properly in any recount. None of these beliefs is correct.
One might argue that the inspection and testing of the machine would reveal such abjectly bad behavior, but the claim of DRE opponents is that no amount of inspection and testing is ever sufficient. If testing is adequate to reveal paper flaws, then it is adequate to uncover other faults in the machines.”2004
Conny B. McCormack, Los Angeles County Registrar-Recorder/County Clerk, stated in testimony before the U.S. Senate Committee on Rules and Administration on June 21, 2005:
“Adding another federal requirement for Direct Recording Electronic (DRE) voting systems to be retrofitted with a voter verified paper audit trail (VVPAT) component invites a number of problems that could, unintentionally, shatter the system and significantly erode public confidence in the process…The fact is that existing DRE systems without VVPAT have the proven track record of doing the best job of all available voting systems in achieving the goal of accurate casting, tabulation and reporting of all votes in accordance with the voters’ intentions…
This debate also needs to recognize practical considerations including significant costs, paper jams and malfunctioning printers, voter delays, difficulty for poll workers, and meaningless receipts. If DRE programming can be manipulated, that same logic dictates that the programming could be surreptitiously altered to change election results after the paper ballot is printed.”June 21, 2005
Kay Maxwell, President of the League of Women Voters of the United States, in her testimony before the U.S. Election Assistance Commission on May 5, 2004 stated:
“For the VVPT system to work as a backup for counting the vote accurately, it seems that every voter must verify every ballot… But this is a very tall order. Setting up reliable means for voters to verify, or, more importantly, refuse to verify, their ballots at the polling place adds a significant burden at the polling place…
Even with paper records that are actually voter verified, there are significant remaining questions. There are questions about the accuracy, reliability and fraud-potential for the counting of paper records, with the long history of lost, mangled and manipulated paper ballots…
If a malicious programmer or an outside ‘hacker’ can change the electronic record of the vote, certainly such a skilled person can make the printer provide a paper record that doesn’t expose any error… Under this scenario, the voter and the poll worker are not alerted to the problem. So, in this example, the paper does not indicate a problem with the machine, and does not provide a safeguard.”May 5, 2004
Election Technology Council’s Oct. 2005 “Frequently Asked Questions” section on its website stated:
“Printing voter verifiable ballots adds several layers of cost and complexity to the process, accompanied by increased risk of failure at the polling place and the associated stress placed on poll workers… Even the simplest issues must be thoroughly addressed. For instance, a lengthy set of ballot options would require a lengthy receipt for voters.
The voting process could be ‘intentionally’ disrupted by voters who claim the paper receipt does not match how they voted, thereby putting the entire voting process in question. The time required to vote and verify a paper ballot will likely increase the amount of time a voter spends in the a voting booth, requiring more voting systems and increasing costs.”Oct. 2005