Home page: http://verify.stanford.edu/evote.html

Resolution on electronic voting

Introduction

As a result of problems with elections in recent years, funding is being made available at all levels of government to upgrade election equipment. Unfortunately, some of the equipment being purchased, while superficially attractive to both voters and election officials, poses unacceptable risks to election integrity - risks of which election officials and the general public are largely unaware.

We are in favor of the use of technology to solve difficult problems, but we know that technology must be used appropriately, with due attention to associated risks. For those who need to upgrade, there are safe, cost-effective alternatives available right now, and the potential for vastly better ones in the future. For these reasons, we endorse the following resolution:

"Computerized voting equipment is inherently subject to programming error, equipment malfunction, and malicious tampering. It is therefore crucial that voting equipment provide a voter-verifiable audit trail, by which we mean a permanent record of each vote that can be checked for accuracy by the voter before the vote is submitted, and is difficult or impossible to alter after it has been checked. Many of the electronic voting machines being purchased do not satisfy this requirement. Voting machines should not be purchased or used unless they provide a voter-verifiable audit trail; when such machines are already in use, they should be replaced or modified to provide a voter-verifiable audit trail. Providing a voter-verifiable audit trail should be one of the essential requirements for certification of new voting systems."

We elaborate below.

The Problem

In response to the need to upgrade outdated election systems, many states and communities are considering acquiring "Direct Recording Electronic" (DRE) voting machines (such as "touch-screen voting machines" mentioned frequently in the press). Some have already acquired them. Unfortunately, there is insufficient awareness that these machines pose an unacceptable risk that errors or deliberate election-rigging will go undetected, since they do not provide a way for the voters to verify independently that the machine correctly records and counts the votes they have cast. Moreover, if problems are detected after an election, there is no way to determine the correct outcome of the election short of a revote. Deployment of new voting machines that do not provide a voter-verifiable audit trail should be halted, and existing machines should be replaced or modified to produce ballots that can be checked independently by the voter before being submitted, and cannot be altered after submission. These ballots would count as the actual votes, taking precedence over any electronic counts.

Election integrity cannot be assured without openness and transparency. But an election without voter-verifiable ballots cannot be open and transparent: The voter cannot know that the vote eventually reported is the same as the vote cast, nor can candidates or others gain confidence in the accuracy of the election by observing the voting and vote counting processes.

All computer systems are subject to subtle errors. Moreover, computer systems can be deliberately corrupted at any stage of their design, manufacture, and use. The methods used to do this can be extremely difficult to foresee and detect. Current standards and procedures for certifying electronic election equipment do not require unambiguously that equipment provide a voter-verifiable audit trail. Without a voter-verifiable audit trail, it is not practical to provide reasonable assurance of the integrity of these voting systems by any combination of design review, inspection, testing, logical analysis, or control of the system development process. For example, a programmer working for the machine vendor could modify the machine software to mis-record a few votes for party A as votes for party B, and this change could be triggered only during the actual election, not during testing. Many computer scientists could list dozens of other plausible ways to compromise computerized voting machines.

Most importantly, there is no reliable way to detect errors in recording votes or deliberate election rigging with these machines. Hence, the results of any election conducted using these machines are open to question.

Available alternatives to DRE machines

When a reasonably reliable, accurate, and secure voting technology is already in use, such as optical scan ballots, acquisition of DRE machines would be a major step backwards. However, many areas urgently need to upgrade their equipment before the 2004 elections. In these cases there are several acceptable options available now.

At this time, the only tried-and-true technology for providing a voter-verified audit trail is a paper ballot, where the votes recorded can be easily read and checked by the voter. With appropriate election administration policies (for example, ensuring the physical security of ballots), voters can be reasonably confident of the integrity of election results. Two specific alternatives that are available now are:

Precinct-based optical scan ballots. The CalTech/MIT Voting Technology Project found them to be the most accurate at recording the voter's intent and not significantly more expensive per vote than touch-screen machines.
Touch screen machines that print paper ballots. Such systems would have many of the advantages of DRE machines, including potentially improved accessibility for voters with disabilities. There is at least one such machine that is certified in several states, and we hope that all vendors of existing DRE machines could provide an option to add ballot printers (DRE voting machines in Brazil have been retrofitted with ballot printers, for example). The paper ballots must be submitted by the voters, to be available for counting or recounting and to avoid vote-selling. The votes on the paper ballots must be regarded as the definitive legal votes, taking precedence over electronic records or counts.

Of course, use of appropriate equipment is not sufficient to guarantee election integrity. Elections must be administered to minimize the possibility of error and fraud, and maximize the likelihood of detecting them if they occur. In particular, even with an audit trail, audits must actually be conducted. If electronic counts are used from machines that also print ballots, or if paper ballots are counted electronically, manual recounts must be conducted with enough frequency to make the detection of error or fraud likely.

Future Alternatives

There is certainly room for improvement in voting technology. Elections pose several unique technological challenges, especially simultaneously achieving auditability while preserving ballot secrecy. Voting technology is an active research area that has already produced several proposals that promise to be much better than any system currently in use. For example, there are proposals that may be able to eliminate the possibility of "ballot box stuffing." Unfortunately, if available funds are spent on fatally-flawed "high-tech" voting equipment, it will be a long time before there is more funding to adopt truly superior voting technology.

Conclusion

The conduct of elections has been taken for granted for too long. Election reform is now receiving much-needed attention, but we must guard against changes that inadvertently create even worse problems. Unauditable voting equipment will erode confidence in our elections, causing further disillusionment of the voting public.

Click here if you would like to endorse this statement.

Please email questions and comments to "elections@chicory.stanford.edu"

Last modified 1:00 PM, 1/20/2003