Re: On DREs vs. Opscan...

From: Richard C. Johnson <dick_at_iwwco_dot_com>
Date: Wed Jun 20 2007 - 10:25:16 CDT

  Your essay on comparative advantages rings very true for me except for one
  small section near the end, where you write "In contrast, for all 3 paper ballot
  approaches, the paper ballot can be sealed in an opaque envelope with the
  provisional voter's identification on the outside. The envelope is opened only
if and when it is determined that the provisional vote is to be counted."
  In fact, there must be two envelopes, a inner blank one containing the ballot and an outer one containing the voter information regarding the provisional voter. When the outer envelope (with the voter information on it) is opened (only if the voter is accepted and the inner ballot destined to be counted), the blank envelope must confront the gaze of the person knowing who the voter is. This person having the outer ballot with voter information on it must NOT see the ballot itself. Then, the blank envelopes containing the ballot must be put into a separate box and, in turn, be opened by another person without access to the voter information. Any procedure such as you indicate with a single envelope will violate the voting privacy laws of most states; the double envelopes must always be used in provisional (or mail in) voting to insure privacy. IMHO.
  Otherwise, thanks for a great discussion of differences between and among the different voting systems.
  -- Dick

Arthur Keller <> wrote:
  Is anyone interested in fleshing these ideas out for a paper in
VoComp 07? (See previous message about the conference.) Deadline is
7pm PDT on Saturday, June 30.

Let us compare 4 alternatives: DRE with VVPAT, Hand-marked Opscan,
EBM with Opscan, and EBP/PSB with "Opscan"

In a DRE (Direct Recording Electronic) voting machine with a VVPAT
(Voter-Verified Paper Audit Trail), the voter's intent is captured
electronically (a primary electronic record), from which a paper
record is made. The primary electronic record is the ballot that is
counted. While the paper record is available for voter verification,
my experience as a precinct inspector is that many (most?) voters
don't review it. Some reasons the paper record is often not reviewed
are (1) the difficulty seeing the paper record behind a glass
barrier, and (2) some (all?) DREs remove from the screen the voter's
selections when printing the paper record, so it is harder to compare
the two. Furthermore, the paper record is counted only for audits.

In a hand-marked ballot tallied by optical scan, the voter's intent
is captured by the voter directly on a paper document, from which a
secondary electronic record is made. While the secondary electronic
record is counted, the paper ballot is effectively counted by being
used to produce each and every secondary electronic record.

In an electronic ballot marker (EBM), the voter's intent is captured
by an electronic interface similar to a DRE, except that the result
is to mark a paper ballot like those designed for hand-marking. A
voter without reading or visual impairments can verify the paper
ballot, and it is easier for the voter to do so because the voter
physically handles the paper ballot before casting it. As for
hand-marked paper ballots, a machine-marked paper ballot is counted
by conversion to a secondary electronic ballot record. Thus, each
machine-marked paper ballot is effectively counted.

In an electronic ballot printer (EBP) with a printed summary ballot
(PSB), the voter's intent is captured by an electronic interface
similar to a DRE. In contrast to an electronic ballot marker, the
result is to print a summary ballot that lists each contest and the
selections made for that contest. Importantly, if no selection is
made for a contest, the contest is listed with a notation that no
selection was made. The printed summary ballot is scanned for
conversion to a secondary electronic ballot record that is then
counted. In the Dechert architecture, the electronic ballot printer
also maintains a primary electronic record that is compared with the
secondary electronic ballot record, in part to preclude ballot

In the DRE approach, it is always the electronic record that is
counted. The paper record is counted only for audits and recounts.
Thus, reliable and accurate results from a DRE-based system relies on
a combination of adequate audits and voters actually verifying the
paper record.

In the other 3 approaches, the paper record is the official ballot
and it is always used in the counting. While these approaches are
also subject to presentation attacks just like DREs (for example,
splitting the list of candidates for the same contests among two
screens when they could be on the same screen), they are less subject
to the problem that the paper record might not match the electronic
record due to fraud or error. It is easier for the voter to verify a
paper ballot than for the voter to verify the DRE paper audit trail
behind glass. It is easiest for the voter to verify a printed
summary ballot, as the selections are most clearly identified as are
the contests where no selections are made.

Hand-marked paper ballots and electronic ballot markers are most
subject to the retail voting fraud where stray marks are added to the
ballot thereby invalidating it (or adding extra votes, thereby
invalidating one or more contests). In DREs, the electronic ballot
record have the potential to record choices different than that
selected by the voter, which can be caught only if it differs from
the paper trail, which the voter has actually verified, and there is
a hand-audit of the paper records. Some DREs print a bar code on the
paper trail, which also contains a record of the ballot. If the
audit or recount is done by scanning those bar codes, and not the
text printed on the paper record, then it is possible for the bar
code to match the DRE's electronic ballot record, and for both to
differ from the text on the paper record that is verified by the
voter. Using bar codes instead of the text printed on the paper
record for recounts or audits is therefore a security risk that can
defeat the benefit of the paper trail.

Paper audit trails on continuous rolls have at least two other
problems. The first is privacy, as the order of the ballots is
maintained. Since some jurisdictions maintain in their voter signin
log books the order in which voters appear, the potential is there to
use that information to determine how a voter voted. Second,
provisional voters must be identified and the electronic ballot
record must have a matching voter identification. Once it is
determined that the provisional voter's ballot should be counted, the
electronic ballot record for that voter is included in the tally.
Thus, the potential exists to use information about the voter's
ballot selections in the process of determining whether the vote
should count. In contrast, for all 3 paper ballot approaches, the
paper ballot can be sealed in an opaque envelope with the provisional
voter's identification on the outside. The envelope is opened only
if and when it is determined that the provisional vote is to be

Summary: DREs with paper audit trails have more potential for error
or fraud than either of 3 paper ballot systems considered.

Best regards,

Arthur M. Keller, Ph.D., 3881 Corina Way, Palo Alto, CA 94303-4507
tel +1(650)424-0202, fax +1(650)424-0424
OVC-discuss mailing list

OVC-discuss mailing list

= The content of this message, with the exception of any external
= quotations under fair use, are released to the Public Domain
Received on Sat Jun 30 23:17:02 2007

This archive was generated by hypermail 2.1.8 : Sat Jun 30 2007 - 23:17:05 CDT