This diary was originally published after the election in November of 2006 with the title Electronic Voting and the Myth of the Voter Verified Paper Trail.
With the election season currently in full force and the fact that some of Romney's relatives and associates are owners of electronic voting machine companies, I thought it might be worth reposting this diary. I haven't heard many complaints this season that voting machines are incorrectly flipping votes which were so common in 2004, but some might be interested to know just how easy it is to program a computer to do anything one would like. Even swinging votes to sway an election. Although this was written 6 years ago, little has been done during that time to remove these machines from our elections. And, we still haven't been able to view that "proprietary" source code to know what these machines are actually doing. If you have the option, I suggest you ask for a paper ballot!
Electronic touch screen voting has generated a great deal of interest and speculation on this site. Most are concerned the machines can be manipulated, hacked, votes changed, and there is plenty of circumstantial evidence to back those claims. We have good reason to worry!
I've spent a great deal of time thinking about our electronic voting machines. I've also spent a good deal of time thinking about how I would design and implement a voting system that could alter or manipulate the results of an election. I make no claims that Diebold, or any other manufacturers software works, as I'll describe. But I will say, what I'm about to present is 100% feasible, would be very easy to program, implement, and, if it was your desire to alter the results of an election, why a computer and touch screen monitor is a great choice. With or without a paper trail!
If I've peeked your interest, follow me over the fold for some programming lessons and some possible explanations to common questions, complete with user interaction!
I've been a systems analyst, programmer and software developer for more than 30 years. In that time, I've written programs that interfaced with a variety of hardware, printers, monitors, scanners, credit card readers, the equipment that embosses and records data on the magnetic stripes of credit cards, and for those that remember, tape drives and devices that read Hollerith punched cards and punched paper tape.
I've never actually had a touch screen monitor connected to my computer, but I do know how they function. Nor have I ever voted using one! Hopefully, as long as I have an option to use a paper ballet, I'll use the paper every time!
The Touch Screen Monitor
A touch screen monitor is actually two separate devices combined in a single unit. It has a display screen like any other monitor but also includes an additional device that essentially replaces the mouse. This additional device is simply a see through skin placed in front of the display screen that has the ability to sense touch and report the location back to your computer, similar in many ways to the touchpad common on many laptop computers.
Touch screen monitors require an additional connection to your computer. Interfaces include USB, some use a serial port, some connect via a "Y" cable to your mouse port and others use some combination of these. Touch screens typically have additional functionality, but for purposes of this discussion, we only need to know that touching the screen replaces the function of left clicking on your mouse. In fact, most touch screen monitors allow you to use the screen and the mouse interchangeably.
There is one noticeable difference between a mouse and a touch screen that needs to be understood. A touch screen occasionally needs to be "calibrated", a mouse never does. When you move your mouse pointer over the screen, the pointer is actually being displayed on the screen. The computer knows the location where the very tip of the pointer is displayed. When you click the mouse, that information is returned to the program. With the touch screen device, your fingertip is not being displayed on the screen. The monitor displays the screen, the touch screen records where you touched. They are 2 separate devices. For this reason, it is necessary to align the touch device with the display on the screen.
Programming the Screen Layout
When a programmer designs a screen to be used with a mouse or touch screen, two things need to be considered. First, what is going to be displayed on the screen, and second, what area of the screen will we accept a click of the mouse or a touch of the screen to activate a function. Many times these will be identical, but certainly not required. Fortunately, this is easy to demonstrate on the DailyKos screen you’re currently viewing.
So! Let's do some testing with the mouse! Scroll down to the end of the diary. If the diary comments are not displayed, click View Comments. Notice the line that starts with the word Comments. Next, notice the options Expand, Shrink, Hide, and the box, Always. Starting with your mouse pointer just below and to the right or left of one of the circles, slowly move your mouse towards the circle. Notice how the circle changes color before you actually reach the interior of the circle. If you continue to move the pointer around the circle, you will discover the area setup to accept a click of the mouse, is actually a box approximately the same size as the box next to the Always indicator. Go ahead! Try it! I'll wait!!
Now, scroll upwards and perform the same test on the Diary Recommend button on the right side of the screen. This time, slowly approach the recommend button from outside the border on the right and slowly move the pointer to the left, towards the recommend button. Notice that once inside the border, but still outside of the area marking the boundary of the button, the star to the left of the button changes color from orange to black. You would think this indicates you can click in that location and that would activate the recommend button. Try it! Nothing happens! In this case, the mouse pointer must be inside the recommend box before you can click to recommend the diary. And while you're up there, why not go ahead and recommend the diary so others will get a chance to read this! See how easy it is to manipulate the vote!!
System Design Requirements
The first phase of any software development project is to layout the requirements of the system. For my hypothetical example, I used the following criteria:
1) Develop an Electronic Voting System that can be used to manipulate election results with or without the use of a Voter Verified Paper Trail.
2) Ensure that the manipulation of votes goes undetected by even the most well-informed and skeptical DailyKos voter.
3) Ensure the manipulation of votes happens in a randomized fashion that leaves no discernible pattern that might be used to detect the manipulation of voting results. In other words, don’t get caught!
Analysts Recommendations
After reviewing my system design requirements, I decided the best way to meet the criteria was to manipulate the voting screen in such a way as to always favor the party of choice, in this case, the Republicans. This will be accomplished by intentionally inducing voter mistakes, resulting in votes cast for other parties, to be recorded for Republicans. In fact, I intend to use the voter’s own lack of attention to accomplish that goal, while at the same time make the voters themselves at least partially responsible for the errors. That doesn't sound like an easy task! In actuality, it is much easier than you might imagine! As the saying goes, “...fool me once, shame on — shame on you. Fool me — you can't get fooled again." or some such nonsense!
It may not be easy to get that well informed, skeptical DailyKos readers vote, but I don’t need every vote. I only need to get a few per hundred to alter the results of a close election. The votes I’m after are the ones being cast by the unsuspecting, inattentive voters like Grandma Millie.
The first line of my hypothetical program might read something like this:
Set IWantRepublicansToWin to True
The Voting Screen
There are many things to be considered in developing a computerized system, file layouts, security measures, data storage requirements, but for the purpose of this discussion, I want to focus mainly on the screen design.
Using the software I regularly use for development I have designed my simplified voter screen. This is the same screen the voter will always see while casting a vote. It might look something like this:
When you press the Vote button next to the party of choice, the program performs the following steps:
1) Clear any check mark in the box to the right of the Vote button if the voter had made a previous selection by mistake.
2) Place a check mark next to the party the voter chose. In the example above, the voter pressed the button for the Democratic candidate. This provides immediate confirmation back to the voter on which candidate they selected.
3) And finally, temporarily, record the vote for the candidate selected. In this case, the Democratic candidate.
Setting up the Touch Screen (or mouse regions)
Next, I need to layout the region of the screen that will be used to detect where a voter touched the screen. This could be identical to the size of the actual Vote button, but since we are using a touch screen, to aid those with large fingers or the elderly who are not so steady with their hands, I decided to make it a little larger. After all, I'm the analyst and programmer, who will stop me! In the example below, I have color coded the touch areas to make it clear what will activate the vote function. Please keep in mind, that the program will always use the borders surrounding these colored boxes to determine which box to place a check mark! In an honest election, these borders would also be used to determine which party receives the vote. But, it doesn't have to be programmed that way!
Now, suppose the next voter sets down to vote and the statement above "Set IWantRepublicansToWin to True" has been executed. Before resetting the screen for that voter, the program looks at the current vote totals and determines the Republican candidate is losing! What could the program do to assist the voter in making a mistake? Well, the program could just modify the touch screen detection boundaries used to detect who receives the actual vote. The area that determines which candidate gets a check mark remains the same. But, depending on where the voter touches the screen, within that area, determines which party actually receives the vote and which candidate will be displayed on the confirmation screen. The touch screen area might be modified to look something like this:
The program logic that processes this screen might look like this:
First, set the check mark next to the candidate selected:
If VoterPushedDemocraticBox
Place Check Mark Next to Democratic candidate
else
If VoterPushedRepublicanBox
Place Check Mark Next to Republican candidate
else
If VoterPushedIndependentBox
Place Check Mark Next to Independent candidate
endif.
Next, determine which candidate actually receives the vote:
If VoterTouchedBlueArea
Set VoteCastForDemocrat to True
else
If VoterTouchedRedArea
Set VoteCastForRepublican to True
else
If VoterTouchedYellowArea
Set VoteCastForIndependent to True
endif.
As you can see, this mock program coding separates the logic that determines where the check mark is placed, which provides immediate feedback to the voter on which selection they chose, from the logic used to determine which party candidate is actually credited with the vote. This is the selection that will eventually be shown on the confirmation screen.
Because the program is trying to make certain, IWantRepublicansToWin, we really don't care if we take the vote from an independent voter or a democratic voter, so long as the Republican candidate is winning! This example could also provide an answer to the question, "Why don’t Republican voters ever complain their votes are being switched". In this example, it would be almost impossible for a voter who wanted to cast a vote for the Republican candidate to inadvertently cast, and have their vote recorded for, anything but the Republican candidate!
As you can see, there is nothing in this program coding that is rocket science, this is just routine, simple, programming logic!!
Now, suppose the Republican candidate is not only losing, but let's say they are now behind by more than 5%. The program could again modify the touch screen area to be a little more aggressive, inducing even more voter mistakes. The touch screen area might be modified to look like this:
Again, in this example, if the voter presses anywhere in the box next to the Democratic candidate, the check mark will appear, just as it did before, but the area that will actually record that vote for the Democratic or Independent candidate has been reduced even further, increasing the likelihood of the voter making a "mistake". Note that the program logic employed to determine which party actually receives credit for the vote remains identical to the example shown above. The only thing that has changed? There is now more "red area" defined in the touch screen detection area.
The Confirmation Screen
As I understand the electronic voting systems currently in use, after the voter has cast a vote in all races, federal, state and local, as well as state propositions and any local measures or bond issues, the voter is presented a "confirmation screen" where they have the opportunity to review their selections. They are given the opportunity to either confirm those selections or given an option to change any that were recorded incorrectly. Expressed another way, to correct any "mistakes".
In my simple, one race example, you wouldn't need much time to determine if the vote you cast for the President was correct. However, I recently read that the typical voter this election cast votes on 40 separate ballot choices. Having to review and verify 40 different ballot choices on the confirmation screen would take considerably more time and attention to verify your votes were cast as intended. How much time might a voter actually spend reviewing this screen when they already confirmed on each ballot choice that the check mark was displayed next to the intended selection? Particularly, if there is line outside the voting precinct six blocks long and you are on your lunch hour and need to get back to work!
Step back for a moment, and think about what happens when you're checking out at the grocery store. The items the cashier runs past the scanner are displayed on a screen that you can review in real time. A receipt is also being printed simultaneously. What if the grocery store had a policy of "all sales are final" and instructed you to verify your printed receipt before leaving the checkout stand? Would you stand there and review the receipt comparing the price marked on each item with the price shown on the receipt? What if 20 people are standing in line behind you waiting to check out? I doubt it! In fact, how many of you even look at the printed receipt after checking out? Unfortunately, that is exactly what they expect you to do when casting your ballet.
Myself, I simply watch the items as they appear on the display as the cashier runs them past the scanner. I just like to verify that a bag of kitty litter doesn't show up on the display since I don't own a cat. But rarely, if ever, do I take the time to carefully review the printed receipt. In fact, I can honestly say, I’ve never stood at the check out stand and reviewed the printed receipt checking the prices of individual items. What would make anyone think that the typical voter is anymore attentive when reviewing their voting confirmation screen, or a printed receipt of their votes, if they were to receive one?
In this scenario, I’ll easily be able to catch a few unsuspecting voters who press Confirm walk out of the polling precinct, tell the exit poll takers they voted for the Democrat and go on there merry way. Could this explain why, in the past few election cycles, the exit polls haven’t matched the actual vote? I’ll let you come to your own conclusions!
However, my hypothetical little program still has a problem! What am I going to do about those pesky, well informed, skeptical DailyKos readers? I know in advance, they are not going to let these little “mistakes” go unnoticed and unanswered! So we add a little extra logic to the program. You could call this, very low level Artificial Intelligence.
Let’s say I have one of those pesky voters who are actually paying attention to the confirmation screen and/or the Voter Verified Paper Trail. The first time through, they catch my induced little mistake! Even though they were certain they selected the Democrat, they go back up and once again try to vote for the Democrat. This time they might get lucky and actually touch the “sweet spot” that will both place the check mark next to the Democrat and record the vote as intended. In this case, the program will just let this voter pass and start looking for the next unsuspecting voter.
But what should the program do if this pesky little voter tries again and it still records the vote for the Republican? If you’re like me, you’ll probably start screaming that the machine is flipping your vote and demand the poll worker come over so you can have an eyewitness to verify the “malfunction”! Ahhh!! But I’m the programmer and I’ve already anticipated this! It’s time to employ a little of that “artificial intelligence”. Since the program knows this is the second time you have cancelled out of the confirmation screen to correct a “mistake”, the program assumes you must be one of those pesky little liberal voters and the third time the program sets up the touch screen area for the presidential vote, it sets it back up in “honest” election mode!
With the poll worker by your side, you once again select the Democratic candidate, the check mark appears as it should, you get back down to the confirmation screen but this time the vote is correctly recorded for the Democrat. You start to explain to the poll worker that it really did record the vote twice for the Republican. The poll worker gives you a funny look and walks away mumbling something to himself like “Why is it I only have problems with Democratic voters?” You walk away feeling a little foolish for making a scene, all the while wondering if it was you or the machine? Remember, one of the main design requirements was “Don’t get caught!” The program now goes back and quietly waits for the next unsuspecting voter to show up!
One of the other design requirements was to ensure that manipulation of votes happen in a “randomized” fashion. The program doesn’t need to do much to make this occur. In fact, the program doesn’t really need to do anything. Assuming, this same identical program is running on every individual voting machine, which also makes it very easy to distribute the software, the voters alone will take care of the randomization. Take an election where pre-election polls show the Democrats with an edge of 52% to 48%. One would think, for every 100 voters who vote on an individual machine, 52 will be Democrats and 48 will be Republicans, but that will rarely be the case. Sure, there will be some machines that get this makeup and on that machine the program will attempt to induce a couple of “mistakes”, slip it past the voters until the Republican is winning, at which time it reverts back to “honest” mode and no longer attempts to induce any more “mistakes”. In other cases, there may be 80% Republicans voting on a machine and only 20% Democrats. This machine is never going to attempt to induce any mistakes because the Republican has been winning the entire time.
It’s the machine that has 80% Democrats voting, and only 20% Republicans that represents a problem. These machines are “working hard” trying to get the Republican elected! There will be plenty of unsuspecting voters who won’t catch those induced mistakes, but there will also be a number of well-informed voters who will be having problems and many of them will bring this to the attention of poll workers. If there are enough complaints, the poll worker might take that machine out of service. Or find it necessary to “recalibrate” the machine. The voting machine companies have explained away these errors as “calibration problems with the touch screen”. I have no way of knowing what they actually do when they “recalibrate” one of these machines, but somehow, once recalibrated they seem to work just fine. I have to wonder what happens during this recalibration. Could the current vote totals in the machine be moved to a permanent storage device and retained so the totals continue to match the Voter Verified Paper Trail and the internal totals in the machine reset to zero so the machine no longer has a majority of Democratic votes? I can’t answer that, but if I were designing the system, it certainly could!
If you’ve read this far you might be thinking, “This might be possible, but anyone looking at the program source code would be able to see this”. That’s true! Unfortunately, the software that runs these machines is considered proprietary, only a select few have ever been allowed to view the program source code. I’ll get back to this, but first let’s take a look at some of the Voter Verified Paper Trail options that currently exist.
Voter Verified Printed Paper Trails
I attempted to post a comment in another election diary to explain what I have presented above and was quickly met with a number of rebuttals. Some of these rebuttals came from other programmers who stated, "Why show an incorrect selection on the confirmation screen? Why not just show a vote for the Democratic candidate on the confirmation screen and just internally record a vote for the Republican candidate?” They claimed, "... all the discrepancies that appear on the confirmation screen can be explained by errors in the calibration of the touch screen monitor". I mentioned the possibility of a paper trail and was informed, the machines being discussed, produced no paper trail.
I suspected the reason the confirmation screen needed to show the incorrect vote was that a paper receipt and a voter verified paper trail might be an existing option on these machines. If so, the totals kept internally in the machine, must match exactly the votes recorded on the paper trail. If anyone were to go back, tally the results shown on the paper trail and find those totals don't agree, evidence of fraud would be clear.
I had some pre-conceived ideas on how a Voter Verified Paper Trail might function, and naturally assumed the voter would get a receipt showing how they cast their votes. Just imagine, if you will, as a skeptical, well informed DailyKos reader, you diligently spend the time to review the confirmation screen and everything is correct. You press the Confirm button and the Voter Verified Paper Trail is printed along with your receipt and you discover the vote you cast for the Democratic candidate now shows a vote for the Republican candidate. Your vote has now been recorded and all you have to show for it is a printed receipt that shows you voted for the Republican.
I don't know about you, but, if that were to happen to me, I wouldn't need any further proof of fraud! I'd make sure that no one else would ever be able to cast a vote on that piece of equipment again. I would physically destroy it on the spot and almost certainly end up in jail moments later! And I wouldn't care!
I visited each website of the three major companies, Diebold, ES&S and Sequoia. As I suspected, each provides an option to include the voter verified paper trail. This confirmed, why it was necessary that the incorrect vote be displayed on the confirmation screen. The internal numbers must match what's printed on the paper trail.
Diebold calls their paper trail option the Diebold AccuView Printer Module. ES&S calls theirs the ES&S Real Time Audit Log and Sequoia refers to theirs as the Sequoia AVC Edge with VeriVote Printer.
Much to my surprise, they worked nothing like I imagined and as far as I can determine, none of them provide a "receipt" that the voter gets to take home with them!! How convenient!! If their programs functioned as I described above, the last thing you would want is to hand the voter a receipt they might review at a later time!
All of these devices appear to be just an option that can easily be added to their standard voting systems. So how do they work? In the case of Diebold it appears the paper trail is printed at the same time the confirmation screen is displayed and requires you to verify both the confirmation screen and the paper trail simultaneously. That should certainly speed up the voting process!
From Diebold's website:
The AccuView Printer Module provides a clear, accurate printout of each voter’s selections, which is viewable through a transparent window in the unit. The selections displayed on the paper printout can be easily compared to the summary screen on the touch screen voting station, which lists each race and selection in the same order. The ability to simultaneously check selections against the summary screen significantly simplifies and streamlines the verification process for voters.
Voters can easily change their selections after the paper-based replica of the selections has been created by simply touching “reject ballot” on the touch screen. The AccuView clearly indicates that the preceding selections on the printout are cancelled.
The number of times a voter can cancel their printed selections and modify their choices can be limited upon the determination of the jurisdiction.
Once a voter verifies their selections and casts their ballot, a bar code is printed at the end of the paper selection trail, enabling recounts to be conducted manually or through the use of a bar code reader.
I want you read those last three paragraphs again. Can you imagine how difficult it would be to go back and manually count each ballot if the ballot is filled with cancellations?
It's the second paragraph that really troubles me! If I exceed this "limit" on the number of times I can correct my ballot, what the hell are they doing with my ballot? Are they counting it and recording it for the candidate I didn't want to vote for? Are they just throwing away my entire ballot and discarding it because I couldn't get the machine to properly record my vote in the number of tries permitted? To use a phrase of Donald Rumsfeld, Who knows!!! The literature certainly doesn't explain what happens!
And, paragraph three! If there were to be a recount, which method do you think might be employed to recount those ballets? Manually? With all those cancellations? Or the bar code method? Is there anyone reading this that can easily determine what information is contained in a bar code? I didn't think so!
The ES&S system, at first glance appears to be a little more straightforward. As you cast each vote for a race, it appears the printer prints that vote at the time of selection. I would assume, this happens at the same time as you move from one race on the ballot to the next. It offers no explanation of what happens when changes are made at the confirmation screen. Nor is there any explanation on what methods can be employed during a recount.
And the Sequoia system? From the photo, it appears there is a printer module attached to the standard voting system, but looking at the information on their website, I haven't a clue how this one works! It appears that a paper audit trail can be printed after the polls close, but there is no explanation how a paper trail works for the voter.
From Sequoia's website:
The Audit Trail provides an unalterable electronic record of all votes cast during an election. This record is redundantly stored in the AVC Edge® and on the Results Cartridge. Additionally, a chronological Event Log records the time, date, and nature of all significant system activity. Both the Audit Trail and Event Log can be printed after polls close.
After the polls close?
All of these systems have one thing in common. It is the responsibility of the voter to verify and re-verify that the votes they are casting are recorded properly on the voting screen, the confirmation screen and the paper trail. Once your votes are cast, you are still not provided with a clearly printed, easily readable receipt that could be used to confirm your votes were cast as intended.
Open Source vs. Propriety Software
If there is any one item in regards to electronic voting software that should concern every voter, it is the realization that only a select and obscure few have ever been allowed to review the source code for these Electronic Voting Machines. For a nice explanation of Open Source vs. proprietary software here is an article from the Baltimore Sun on Diebold's Proprietary Software.
In my hypothetical example above, it would not take much investigation to discover what the program was actually doing. When you add in all the security, the storage of data, the ballot creation process and the other functions required to make a complete system, I can imagine there might be 10’s of thousands of lines of source code. If I actually believed that these machines could somehow be made trustworthy and reliable, which I don’t, there is one requirement that would be an absolute. The source code for the program that runs these systems must be made available to anyone and everyone who wishes to see it for review and inspection.
In December of last year, Diebold went so far as to Pull Out of North Carolina rather than allow the state to review its source code. I think there is only one logical question that can be asked. What are they trying to hide? Does their program do something as I've described above? We will never know until experts, and lots of them, have had the opportunity to review their program source code.
Even with Open Source software it would be very difficult to ensure the source code you are allowed to view, is actually the software running on these machines. Add to that, the many other documented ways that the machines can be tampered with and I'm convinced it will be nearly impossible to ever ensure these machines are 100% trustworthy and reliable.
The Diarist's Conclusions
Those that have power want to keep it! We have already seen the extreme measures these people will take to influence the outcome of an election. Be it voter disenfranchisement, voter intimidation, unequal distribution of voting equipment, to simple phone jamming, there is no trick they won’t use. Allowing private corporations, who have a vested interest in the outcome of an election, who have openly stated their preferences for one political party over another, to develop and implement a voting system using such an easily manipulated tool as a computer is a grave threat to our Democracy.
It only takes a small percentage of votes to be changed in a close race to completely reverse the outcome of an election. A voter verified paper trail might make some more assured that their votes are being recorded correctly. But it’s only helpful if every individual voter diligently reviews those confirmation screens and paper trails! I’m not willing to trust the due diligence of every voter who may not understand how a computer functions, to know what to look for, to understand how important it is to review every step the computer takes, to ensure their vote is counted as intended.
We need to move back to paper ballots and we must do so immediately. We need ballots that are completed by the very hand that casts that those votes. It may still be possible to utilize technology to count those ballets more quickly, but they should also be redundantly hand counted to ensure there are no discrepancies, regardless of the cost. And the voter should receive a clearly readable, printed receipt that can be verified by the voter at the polling place and at a later time to ensure their votes were not manipulated.
To those who may still believe that adding a voter verified paper trail to these machines would ensure the accuracy and integrity of our elections, I urge you to think more carefully.
It is nothing but a myth!