Reel to reel vote storage

From: David Jefferson <d_jefferson_at_yahoo_dot_com>
Date: Mon Aug 16 2004 - 20:03:12 CDT

I have never seen a quantitative analysis of voter privacy, although I
am sure someone must have written about it. I would propose one along
these lines, which illustrates the danger of reel-to-reel recording of
ballots or the VVPAT.

We can quantify privacy by the uncertainty regarding which vote belongs
to a particular person. In the days of paper voting, when there was
only one ballot box per precinct and all ballots went into it, at the
end of the day the most that could be known about one person's ballot
was that it is one of the (say) 200 ballots cast in that precinct
(assuming perfect randomization within the ballot box). Or, in the
case of a primary, we could know it was one of the 100 Republican (or
Democratic) ballots cast that day. (Minor party members have always
had much reduced privacy--there may only be one Green vote cast in a
precinct all day, and in a primary it is quasi-public information who
that Green is.)

If we have, say, 4 voting machines in a precinct, since it is easy to
note who votes on what machine, that privacy level goes down to 1 in 50
in a general election, or 1 in 25 for major party primary voter! This
"privacy" level is getting mighty thin.

If you then further degrade the situation by storing votes in order on
a reel, and you know almost ANYTHING about the voter or his time of
voting, you can narrow the privacy level to 1 in 5 or worse. Clearly
the first or last voter of the day on each machine has no effective
privacy at all.

(The above analysis could be cast information theoretically as well, in
terms of the number of bits of vote privacy you have and taking account
of probabilistic knowledge one may have; but the above illustrates the

While it is ordinarily true that only election officials will have
access to the paper ballot reel, if you want badly enough to know how
any particular person voted (say a prominent person, or someone you are
coercing) I am certain it would be easy enough to accomplish with help
from an insider. To me that is unacceptable.


On Aug 16, 2004, at 5:35 PM, David Mertz wrote:

> Charlie Strauss wrote:
>>> Now in principle some evildoer could stand outside and record
>>> people entering and leaving. Also a poll worker with the memory
>>> of Kreskin could memorize the order.
> On Aug 16, 2004, at 7:24 PM, Alan Dechert wrote:
>> The entire order need not be memorized to violate the right to a
>> secret
>> ballot. If only the last person to vote is known, then his or her
>> ballot
>> would be known to be the last one on the roll. I think that
>> revealing a
>> single ballot would be a violation.
> I don't think Charlie fails to understand the advantages of the OVC
> design. I think he would urge--and certainly I would--that anonymity
> protections be considered as shades-of-gray, not simply as
> black-and-white. And also, channeling Charlie, I think human
> procedures are very important, along with actual technology and
> designs.
> The OVC design is pretty darn good; the VeriVote system is
> significantly less good. But VeriVote VVPT is still a big step in the
> right direction from DREs. Having some nuance to our comments on the
> different systems is a good thing.
> When counties are considering voting machines for 2004, it's not a
> choice between Diebold DREs and the ideal systems OVC hopes to build
> in the future. They need to actually run the election *this year*. I
> wish we had something to sell to counties right now, but unfortunately
> we're not quite there. Given the concrete choice, Sequoia's VeriVote
> is a relatively good option. Of course, there's nothing really
> *wrong* with paper-and-pencil ballots, so for a lot of places not
> buying anything is better than buying VeriVotes. It depends on
> context.
> Yours, David...
= The content of this message, with the exception of any external
= quotations under fair use, are released to the Public Domain
Received on Tue Aug 31 23:17:13 2004

This archive was generated by hypermail 2.1.8 : Tue Aug 31 2004 - 23:17:23 CDT