Re: securing electronic ballots

From: Douglas W. Jones <jones_at_cs_dot_uiowa_dot_edu>
Date: Wed Nov 26 2003 - 09:00:18 CST

On Nov 25, 2003, at 11:35 PM, David Mertz wrote:
> Lori Flynn <> wrote:
> |I am curious why voters need to physically touch the ballot at all.
> What
> |I've heard about voting in Brazil (where 100% of the population is
> |required by law to vote at national elections, and where 100% of the
> last
> |presidential vote was electronic) is that a paper ballot is printed
> which
> |is visible behind glass to the voter.

This is the same idea used by the Avante voting system sold in this

There are several models you can follow when it comes to a
paper trail. In one model, the voter looks at the ballot through glass
to verify that it is right. In that case, what do you do if it is
Solving this problem requires mechanisms and introduces new
for confusion.

In the alternative model, you print out the ballot and hand it to the
user. Populex does this, and so does at least one other, I forget the
name. This requires no complex mechanism for accepting or rejecting the
ballot; it lets the voter do this by hand. Instead, it relies on the
voter to deliver the ballot to a ballot box equipped with a scanner, and
at that point, you raise security problems with questions about ballot
box stuffing. This requires mechanisms and introduces new opportunities
for confusion.

I see no inherent reason to trust one model more than the other, and no
inherent reason to believe one model will involve more complex
than the other, but ...

> The voter verifies that indeed it
> |shows the correct choices made.

Here we say something very simple "the voter verifies it" without
thinking about the difficulty of verification. Someone needs to do the
experiment of building a touch-screen (or equivalent) voting system and
then rigging it to deliberately misrecord a vote on each ballot, and
run real voters through the system and see what percentage of voters
don't notice the error. I strongly suspect that different approaches
to voter verification will lead to distinctly different rates of voters
catching the error.

We have a data point. The Palm Beach butterfly ballot in 2000 used a
voter verifiable paper ballot -- the punched card. In theory, voters
can verify that the punches in the card match their intent. It's not
that hard. Pull the card out of the Votomatic, look at the punch
of the holes in the ballot, and match them with the numbers printed on
the ballot label you used to find the holes you punched. In practice,
hardly anyone does this, illustrating clearly that the fact that a
is theoretically voter verifiable does not lead to it being, in fact,

> Brazil indeed does a lot of things right. Overall, their system of
> democracy is more advanced than ours in the USA.

Not really. As of the last time I heard anything, the printers on their
voting machines were turned off because of some court decision. Also,
voting systems for Brazil are relatively trivial. There is only one
race on the ballot, Member of Parliment. This makes everything far
simpler. Remember, only the United States and Switzerland have
systems where we vote on everything from drain commissioner to president
on one ballot in a general election. The standing joke is that a
California voter casts more votes in one election than a British citizen
casts in a lifetime. In most of the world's democracies, you vote on
MP, and the Parliment appoints the people who appoint the people who
appoint the drain commissioner.

                                        Doug Jones
= The content of this message, with the exception of any external
= quotations under fair use, are released to the Public Domain
Received on Sun Nov 30 23:17:09 2003

This archive was generated by hypermail 2.1.8 : Sun Nov 30 2003 - 23:17:13 CST