Re: MORE Questions from election officials

From: james_in_denver <james_in_denver_at_hotpop_dot_com>
Date: Tue May 04 2004 - 01:03:09 CDT

I am new to this effort (thank you Alan!) but just some thoughts on Dr.
Shamus defense of paperless DRE's.

First and foremost, he assumes that there is, statistically speaking, an
acceptable number of votes that may be mis-tabulated. He continues on
that path and takes for granted that these incorrectly tabulated votes
are of no concern, provided that they fall into "acceptable limits".

This premise is reasoned from a statistical point of view. However it
fails to take into consideration that any mis-tabulated vote is in
violation of that individual's constitutionally protected rights of
franchise!. It is inconceivable (well to me at least), that anyone would
willingly accept having their rights stripped of them, even if on a
statistical basis. And in the case of paperless DRE's, not even be able
to prove that such a violation had occurred.

1.1.3 He states "Neither needs to operate perfectly",

Fails to recognize that no-one would willingly get into any plane
knowing that some vital piece of that plane was imperfect or flawed. The
public assumes that each and every plane will perform flawlessly in it's
task of taking off and landing.Otherwise no-one in their right mind
would risk boarding it. This obviously cannot be said of current DRE's.
The public, given that we face risks every day, still does everything in
it's power to minimize those risks. It is called the survival instinct.

1.1.4 "But that ignores the real political fact that elections are local
and local party"

This totally ignores national elections IE: Bush v Gore in Florida.

1.2 "The argument I have with DRE opponents is that they insist that any
conceivable risk of any kind of manipulation is unacceptable."

So is he saying that some form of voting manipulation IS acceptable?

1.2 "A decompiler can be used to verify that the malware is not present
and/or that the object code being used corresponds to the original
object code"

So he is saying that the object code will be freely available for all
DRE's? and that decompiling it would not violate federal copyright law?.
If that is the case then the entire source code for each election should
be publicly available for review prior to, and after each election.
Isn't that what the openvotingconsortium is about?

1.4 "Only if the relevant programming is transparent and available to
the public should we be confident about using it"

Same argument as above in 1.2

1.5 "By far the most justifiable criticism of DRE machines is that they
fail during service or in some cases cannot even be brought into service
on election day. There are numerous documented instances of such
failures. These incidents are real. They are intolerable when they
interfere with the act of voting.... They do not suddenly decide to move
votes from Democrats to Republicans.".

Again given that this is not the case, it is still a form of
disenfranchisement, at least on an individual basis.And again,
statistically speaking, he cannot make the claim that any given failure
will affect each candidate/issue similarily.

2 "It has been asserted that adding paper trails to DREs allows prompt
detection of all of the possible intrusions discussed above. It is
based on the mistaken belief that paper records are in some way more
secure or free from tampering than electronic ones, which is not the
case.....the Central Election Commission had to declare 337,297 ballots
as invalid, more than 11 times the supposed margin of victory. The
voting method was by paper ballot, and there weren’t even any DRE
machines to blame. Surely if the voters could rely on the paper ballots
to be counted properly this result could not have occurred"

Presupposes paper only balloting.

2.1 "Sen. Clinton is correct that Regulation E of the Federal Reserve
Board[18] requires a financial institution to make a receipt available
when a consumer initiates an electronic funds transfer at an ATM. She
might be surprised to learn how limited the legal effect of the receipt
turns out to be. If a financial institution fails to provide a receipt
through “inadvertent error,”

However, it provides that such records be available, anything less, as
noted above, is “inadvertent error". It seems to me that Dr. Shamu in
his argument for paperless DRE's is willing to propagate that
"inadvertent error" to each and every voter.

2.1 "Sen. Clinton would be positively dismayed to learn that a lottery
ticket has even less value to its holder than an ATM receipt. State
lottery rules typically provide that if a dispute arises between the
holder of a lottery ticket and the state lottery bureau, the computer
records of the lottery bureau govern. This New Hampshire Lottery rule
is illustrative: “To be a valid ticket and eligible to receive a prize …
[t]he information appearing on the ticket shall correspond precisely
with the Commission’s computer record.”[22] The lottery rules clearly
provide that computer records govern over paper ones"

Well, again, he strays far afield here. That statute's intent is to give
the New Hampshire Lottery Commission the right to contest apparently, or
demonstrably fraudulent, lottery tickets. In those circumstance the
Commission may contest the validity of any given ticket. However, if the
number on the ticket is verifiable against the lottery database, the
ticket must be honored. This clearly places at least some burden of
proof of fraudulence upon New Hampshire's Lottery Commission, not the

2.1 again, (sigh), "the lottery ticket is simply a receipt, that is, an
item of evidence that can be considered in the event of a dispute".

Exactly the point of having VVPB.

2.2 (finally!) "“any transaction in or affecting interstate or foreign
commerce … a signature, contract, or other record relating to such
transaction may not be denied legal effect, validity, or enforceability
solely because it is in electronic form."

This holds true: absent any printed record or contract to confirm or
validate the transaction.

2.3 "Other types of manipulation, such as destroying ballots or
substituting other ones, require no skill at all"

Exactly the problem that DRE with VVPB addresses

2.3 "The simplest form of paper ballot manipulation is ballot-box
stuffing, that is, inserting extra ballots, usually genuine ones that
have been pre-marked, into the container meant to hold only those voted
by registered voters"

Exactly the problem that DRE with VVPB addresses.

2.4 "It is alleged that adding a so-called “voter-verified paper trail”
to a DRE machine will either permit tampering to be detected or at the
very least will provide a reliable record of how each voter voted that
can be used for a recount, even if the recount must be conducted by
hand. This is incorrect."...

No, I beg to differ Dr. Shamu, however, if the VVPB contains a record of
an individual' vote then that would be a fairly reliable record of that
individual's intent,

Dr. Shamu continues
.... A paper trail accomplishes one thing, and one thing only – it
provides assurance to the voter that her vote was initially captured
correctly by the machine. This is no small accomplishment, but it can
be achieved in numerous other ways, as explained below. That is the
only voter-verified part. The paper trail provides no assurance at all
that her vote will ever be counted or will be counted correctly. The
reason simply is that the paper trail itself becomes insecure at the
moment of its creation"

Hmmm, at first thought, I had a rebuttal for this, however, if any
"central tabulation" computer/server has been compromised, I am not
certain there is a means to verify that an individuals vote has been
tabulated correctly. Definatally needs more thought.

2.4 "First, if the machine cannot be trusted, which is the working
hypothesis of paper trail proponents, then it cannot be trusted to deal
with the paper trail safely. After the voter leaves the voting booth,
it can mark her ballot as void and print a different one. The voter
will have left the booth believing not only that her vote was cast and
counted properly, but that it will also be counted properly in any
recount. None of these beliefs is correct"

This presupposes that a voter does not maintain a verifiable "receipt"
of their voting record. It would be trivial, with a VVPB to be able to
verify their voting choices with internet access from any location.

2.4 "Adding a paper printing device to a DRE machine naturally adds
another component that can fail, run out of ink, jam or run out of
paper. If DREs are alleged already to be prone to failure, adding a
paper trail cannot improve that record. In Brazil in 2003, where a
small number of precincts had installed paper trails, failure of the
printers delayed voters by as much as 12 hours, a figure that would be
catastrophic in the U.S.[32]"

Definately, a valid concern.

2.4 "There is no voter-verified paper trail machine that has been tested
on any large scale."

Just because no-one has bothered to try doesn't mean it won't work.
(Just ask Charles Limburgh).

2.4 "States that propose to implement the paper trail have promulgated
regulations stating that the paper shall govern over the electronic
record in the event of discrepancy[33]. This has the effect of making
the insecure paper record paramount over the secure electronic one, a
return to the early days of the Australian ballot."

Only in the cases where a particular vote, as presented on paper,
differs than that presented by the DRE.

2.4.5 "With complex ballots, voters are prone to forget exactly whom
they have voted for. When confronted with a paper record, they may
erroneously claim that the machine made a mistake. This will call the
machine’s reliability into question, prompt calls for a recount and cast
doubt even on machines that are functioning properly"

Not so, when there is a second, distinct step, in the voting process,
that validates the ballot.

2.4.6 "Paper trails do not address the problem of DRE failures. If the
complaint is that a machine cannot be initialized for use on the morning
of election day, then having a paper trail mechanism is of no help. In
fact, the presence of the mechanism increases the load on the machine’s
power supply and processor and itself increases the probability of

2.4.7 "The paper trail requires a re-examination of meaning of the terms
“ballot” and “official ballot.” This is not a mere semantic exercise,
but a question of great legal and, in some states, constitutional
significance. Can a piece of paper be a ballot if it is neither marked
nor touched by the voter?"

I am newly arrived on this project, however, after several hours of
thought on this matter, PPVB will require that the voter maintain a
"receipt", including his voting record, for that ballot This would
provide the voter with a paper record of his vote, and must be verified
by the voter as part of the voting process. In any event, paper records
take precedence over electronic records, until/unless they are proven to
be false.The burden of proof would not be on the voter, however on
whatever entity was contesting that particular election.

Absolutely so!. In that instance, a DRE without VVPB is of absolutely no
use either. (Homer said it best: "Doohhh!"). And as to the latter half
of that statement, COTS printers have a separate and distinct power
supply from the computer itself. I have never seen a printer, anywhere,
in twenty years of industry experience, derive it's power from the PC it
was attached to.

2.4.8 "Each losing candidate will claim that the election was stolen
from him by the machine and will insist that the only true indication of
the voters’ preferences reside on the paper, even if there is no
evidence of irregularity or tampering. Thus paper recount will become
the default method of vote counting, mitigated only by the high cost of
such recounts. If this is to be the case, why use voting machines in
the first place?"

Okay, so explain to me again how a simple DRE, without a VVPB would fix
that problem? It simply doesn't.

2.4.9 "Paper trails cannot readily be viewed by disabled voters,
requiring them yet again to reveal their votes to strangers in order to
have them verified. It is no answer to say that there are other
mechanisms to review their votes. If paper trail proponents truly
believe the paper trail is necessary for fair elections, then elections
will not be fair for the disabled."

Neither would a simple DRE without VVPB, the visually impaired would
still, at the time of the vote, require assistance. That is not an
argument for DRE without VVPBs.

2.4.10 "A report of the Caltech-MIT Voting project concluded that the
presence of paper trails actually decreases public confidence in the
voting system[34]. The can be understood as follows: would requiring
airplane passengers to inspect the plane’s engines before boarding
enhance their belief in the safety of the aircraft?"

It would certainly increase voter confidence, if that voter had an
oppurtunity, via his "voting receipt", to verify his vote, anonymously,
via the internet.

2.4.10 "My position on paper trails, despite their problems, is not an
extreme one. If a manufacturer produced a reliable paper trail device
and the remainder of his system were acceptable, I would see no problem
in certifying such a machine."

A well designed, PPVB, offers all of the advantages of DRE, with the
bonus of each individual voter being able to verify his voting record.

3.1 (in it's entirety)"A prime motivation for audit trails is the
possibility that the machine has been programmed improperly, either by
accident or by design, or that rogue software has been substituted for
the authorized version. Suppose we were to require voting machines to
be architecturally separated into two distinct devices: a panel,
possibly but not necessarily a touchscreen, whose only function is to
display the ballot and capture voter choices, and a tabulation and
recording device, which accepts input from the panel and performs
computations. The panels and tabulation devices could be supplied by
different manufacturers.
            Now suppose we feed the output of the panel to two different
devices simultaneously. One is the tabulation machine; the other is an
audit device made by yet a third manufacturer and programming by an
independent body, such as an accounting firm or public interest group
not affiliated with the tabulation manufacturer. The audit device
displays the voter’s choices on a screen of its own for verification.
The voter views the audit screen, and if it is correct, presses a “VOTE”
button. Both the tabulation device and the audit device make redundant
read-only records of each ballot image. At the end of the election, all
the records are compared. If they different in any respect whatsoever,
the results from that machine are called into question and an
investigation is launched. An examination of the software installed in
the two devices should reveal whose records are the reliable ones.
            So long as there is no collusion between the audit device
manufacturer and the tabulation manufacturer, no amount of tampering
with either machine will go unremedied. The prospect of tampering
identically with both, since their software systems would be completely
different, is too small to consider seriously. The audit device could
easily be outfitted so disabled voters could verify their votes."

Again, exactly why a well designed DRE, with PPVB, is required to help
gaurentee votes are tabulated correctly.

It is late, will review his remaining points tomorrow, hope you find
this at least mildly interesting, feel free to pass it on to whomever.

James Acomb
> Hello again,
> It turns out that while I was speaking with Denise Lamb (director NASED) this moring, a freind was coinidentally delivering the Mythbreaker's document to Rebecca Vigil-Heron in the same office. She is the President Elect of the National Association of Secretaries of State, and SOS of New Mexico. She is vehemently opposed to paper trails. Unfortunately, I dont beleive she has plans to read it. (Coinidentally She's off to euorpe tommorow to propote paperless systems there -- good timing regarding the Irish report!).
> Anyhow she handed over the following april 2004 Paper from Carnegie Melon as her main scholarly point of reference on the issue.
> by Micheal Ian Shamos, School of computer Sci.
> who also wrote:
> I put these forth for your discussion. If you want to say it's a bunch of bog trot and ill posed analogies I'm fine with that, but the more specific you are the better I will actually be able to make use of your opinions.
> thanks!

= The content of this message, with the exception of any external
= quotations under fair use, are released to the Public Domain
Received on Mon May 31 23:17:08 2004

This archive was generated by hypermail 2.1.8 : Mon May 31 2004 - 23:18:15 CDT