|
 |
July 26, 2003 NO MORE CHADS: IS ELECTRONIC VOTING THE WAVE OF THE FUTURE?....Bev Harris at Black Box Voting has been leading the charge against electronic voting machines for quite some time and linked recently to this "scathing" report on the risks of electronic voting from computer scientists at Johns Hopkins and Rice universities. The report also got some coverage in the New York Times a couple of days ago, and it looks like the issue might start getting some more mainstream attention. The basic problem is this: if voting is completely computerized, how do you know if the computer makes a mistake? This has given rise to some conspiracy theorizing that doesn't strike me as very serious, but conspiracies aside it is true that complex computer systems inevitably have bugs and security holes. For this reason, I'm skeptical of electronic voting even if I don't think the Republican party is surreptitiously buying up voting machine companies and deliberately corrupting their software. Glenn Reynolds thinks the answer is simple: sure, get rid of punch cards, but replace them with paper ballots that are read by specialized scanners. I agree with him. This is known as "mark sense" technology, which I have a lot of experience with (it's basically the same as the Scantron cards used for multiple choice tests), and it's robust, simple to use, and highly reliable. What's more, it leaves behind paper ballots that can be checked in case a manual recount is needed or if someone suspects that the computer has miscounted. But I'll also add one other comment, especially since I took a shot at this last month: if we do move toward completely electronic voting, I can't think of a better candidate for open source software. Legislation should mandate that the source code for these machines — or at least the critical portions of it — be open for inspection. This has become fairly common in security applications, where it's generally agreed that the best way to ensure there are no security holes is to let a legion of experts try to find them. If you can't hack the system when the source code is public, then you just can't hack the sytem. UPDATE: South Knox Bubba, who knows from computers, says we should support the Voter Confidence and Increased Accessibility Act of 2003. Write your congressman! Posted by Kevin Drum at July 26, 2003 11:52 AM | TrackBackComments
I was one of those defending open source in that thread, but I don't think it helps with vote counting machines. The many-eyes-make-all-bugs-shallow would only be true if it's in *everyone's* interests to make sure the "bugs" are found. It might help against accidental problems, but gives zero protection against fraud unless we can assure ourselves that it's the code that's been released that is actually in these machines; that it's impossible to reprogram the machines without everyone knowing; and that the compiler and all libraries used have also similarly been audited and secured. (Compilers have been trojaned before; there's a famouse case involving Ken Thompson - http://www.acm.org/classics/sep95/ ) Here in the UK, we count by hand forms marked with pencil. I hope it stays that way. Posted by: Keith at July 26, 2003 12:21 PM | PERMALINKIt's very simple. There's no need for open source, software verification, "mark sense," or any of the rest. Simply use a "voter verifiable audit trail," like that espoused here: http://www.verifiedvoting.org/ You vote on a touchscreen machine. It prints out a slip of paper with the location, date, time, and who you voted for. You double-check that it matches who you voted for. You slip it into an envelope just like a normal ballot, and it goes into a ballot box. You may or may not get a second copy for yourself. After the electronic results have been tabulated, a statistical sample is taken from each of the ballot boxes. If there's a mismatch, then all the paper ballots are counted. The paper ballots take precendence over the electronic system. Posted by: Lonewacko at July 26, 2003 12:46 PM | PERMALINKOh, and regarding hacked compilers, that's almost a metaphysical question. How will you check the computer that determines that the compiler you're using to compile the source is OK? Will there be an additional program to check the compiler-checking program, and how will you determine that that hasn't been tampered with? And, how will you determine that none of the microcode in all the CPUs being used has been tampered with? Which program will check that, and how will you check that program and the CPU it runs on? Posted by: Lonewacko at July 26, 2003 12:51 PM | PERMALINKKeith - I mostly agree that there are no hugely compelling reasons to go with computers over paper. But I think you're missing the point a little re: open source. First, I have no idea what you mean by "The many-eyes-make-all-bugs-shallow would only be true if it's in *everyone's* interests to make sure the 'bugs' are found"... please clarify why you think unity of interests is necessary for bug-finding. I would think a diversity of interests, some partisan and some not, is a good thing - making it more likely that at least one person will have reason to complain about something fishy. Second, all states still have a certification process for voting equipment, which in the case of software should definitely include verification of the software compilation and installation process. As you say, that's not easy to do. But it's totally impossible to do if the code is proprietary. Posted by: Eli Bishop at July 26, 2003 12:58 PM | PERMALINKI mean that open source gets you protection against accidents but no protection against fraud. Read that link I posted - Ken Thompson says you can't trust any code that you didn't produce yourself - and even then, you can't trust the compiler, the libraries, the microcode in the processor, or that your code won't be switched with some other code the minute you turn away. As far as a verification process goes - unless I wrote every single line of code in the main program, the compiler, the linker, the microcode in the processor, plus all of the verification software (crypto, MD5, whatever) then I wouldn't trust it. And if I did write it all, why should you trust me? I think open sourcing the code would merely give the appearance of security, not give any actual security. Posted by: Keith at July 26, 2003 01:09 PM | PERMALINKIn addition: If we must have electronic voting, I'd go for the scheme Lonewacko mentions above. A paper trail is absolutely vital. If any politician tries to sell me a system with no paper trail, then I'm going to wonder why. Posted by: Keith at July 26, 2003 01:17 PM | PERMALINKWe have been using mark-sense ballots in Tarrant County, Texas for years, but last year they started to try computerized voting for early voting. I voted early, and voted a straight ticket. I learned later that there was also a state constitutional amendment on the ballot, but for people who voted straight ticket, it never appeared. It told me I was finished voting instead. There is, of course, no way to correct that after the election. Apparently they have someone who goes around and runs a program to check that the machines are working correctly. How difficult would it be to add a subroutine to that program that skewed the count towards one candidate and away from another? Then have another subroutine that erased that one an hour after the election was over? How many people are there who ever see the code, and of those, how many could interpret it? Our county has well over a million population. I'll bet good money that there aren't ten people who have ever seen the code that summarizes the vote, and not one of those who rechecks it. It is a vote fraud waiting to happen. Especially since we have only Republicans in the County offices. [All Democrats would be just as dangerous.] I want permanent paper ballots that can be counted by hand and looked at by the voters as they vote. Does anyone think Tom Delay would hesitate for a nano-second to rig the vote? Granted, he is in Houston, not North Texas, but I really don't trust him. Or ~any~ conservative. Posted by: Rick B at July 26, 2003 01:31 PM | PERMALINKNothing is perfect. No matter what you do, there's always the chance that somewhere along the line someone can hack something somewhere. However, open source certainly requires that any conspiracy be a helluva lot bigger and more organized than otherwise. Gotta produce a hacked compiler, or screw with the check-in procedures, etc. That's pretty hard. Plus, even a nodding acquaintance with American history tells us that paper ballots are not above abuse either. I don't think we're looking for perfection here, just something that makes it really hard to cheat. Lonewacko: I agree that an audit trail is a good idea, but I think it's second best because it requires you to review your ballot. A lot of people just won't do that. A mark sense ballot makes you do this in the first place. Posted by: Kevin Drum at July 26, 2003 01:46 PM | PERMALINKCommonweal Institute has a good collection of links to articles and resources on this subject. Posted by: Dave Johnson at July 26, 2003 01:52 PM | PERMALINKHowever, open source certainly requires that any conspiracy be a helluva lot bigger and more organized than otherwise. I disagree. All it means is that you've seen one set of source code. It doesn't mean that the code running on the machines was compiled from that source in any way. If you believe it's possible to commit fraud with proprietary code - that is, write code that skews the results, and keep it secret - then it's possible to do *exactly the same thing* but also release source without the fradulent code in it. If you're just looking for something that makes it hard to cheat, don't bring technology into it at all. Count ballots by hand, one counter and one spotter standing behind them, party officials wandering around the counting halls doing their own spot checks. Recount any close votes. I *demand* that above everything, the voting system be as immune to cheating as is possible. I'm a programmer. I think electronic voting systems make it easier to commit fraud on the electoral system, and I don't see *any* benefit that outweighs that fact. Posted by: Keith at July 26, 2003 02:02 PM | PERMALINKI'm skeptical of electronic voting even if I don't think the Republican party is surreptitiously buying up voting machine companies and deliberately corrupting their software. But none-the-less, it HAS to look suspicious when a senator just happens to own the company counting the votes IN THEIR OWN ELECTION or in the case of Diebold's own board of directors. (scroll halfway down) These things look so bad on the surface. It couldn't scream CONFLICT OF INTEREST any louder. Maybe not the Republican party directly . . . Posted by: Thumb at July 26, 2003 03:15 PM | PERMALINKI have been saying for a long time that we need to stop carving up the Bush Co. talking points and go and look at the rationale for going to war that was fundamental to this group in taking us there. PNAC arguments are interesting and they do tend to change a thoughtful person's point of view. A stable middle east is in everyone's interest. Being held hostage to blackmail like we were during the oil crisis is not something that I think anyone wants to see happen again. The question of how to arrive at such stability however is open to much debate. Those who believe that the only way to get people to behave the way you want them to is stand close and brandish a big stick seem unable to take the step of thinking how the other guy feels when he is treated to that kind of threat. I do not think that war was the answer. However, the war is what we got so how do we make some sense of the disaster so that we can accomplish the task of getting Iraq on its feet without going down to economic defeat for the U. S.? As to GW giving speeches, give me a break. Listening to him is pure agony. I want to snap my fingers and say SPIT IT OUT and stop smirking. Posted by: M. L. Foster at July 26, 2003 03:44 PM | PERMALINKGood for Glenn Reynolds! You won't hear that from me often. What astounds me is that Georgia, Maryland and others thought Diebold was best in show, kinda makes you wonder how bad the competitors are. But we won't be finding out unless they're also stupid enough to leave their internet FTP servers without a password, since accessing the applications on the machines in any state is illegal. What also amazes me is that Diebolds system is so idiotic, they didn't even try to hide how badly it was set up because no one's allowed to look at the code. In the article that broke this, Bev pointed out that votes are entered into the 1st ledger, yet the public vote tally is generated in ledger #2, and no one has figured out why they have a 3rd one. What would you think about a company that uses 3 separate books? Or that you can modify the count w/o leaving a trail? Checkout her link, and if you have the knowledge, download the code and help find what else is wrong with the Diebold system. Maybe if the case against Diebold gets strong enough, someone will force a checkup on the rest of the systems, and I'm betting that would be very interesting. Posted by: Joshua at July 26, 2003 07:10 PM | PERMALINKThe Lonewhacko proposition seems good. I absolutely do not understand why anyone is proposing an electronic system with no paper backup. That is just begging for disaster even when you don't factor in cheating. Posted by: Sebastian Holsclaw at July 26, 2003 07:47 PM | PERMALINKAny even halfway competent programmer could scam the paper trail system in a heartbeat. There's NO way to make computerized voting tamper-proof. and it doesn't require large amounts of expertise to do it. It's easier than stuffing ballot boxes. If you really want accurate voting, gotta go low-tech. Nothing else will work reliably. Posted by: CN at July 26, 2003 07:58 PM | PERMALINKI agree with Keith and CN; I'm a software engineer and I love technology as much as the next guy--more, probably--but there are times when technology is not the right solution. There's no way to make this job easier by taking humans out of the loop and still have it be entirely trustworthy. Voting machines with open source software and a paper trail would be better than what we have now, but still not as good as the low-tech solution. Paper ballots, tallied by hand, are the only really reliable, secure and accurate balloting method there is. Also, assuming volunteer labor is used for the counting, the cheapest. (Which is, cynically speaking, probably the reason we've abandoned them: How can a high-tech company make big money from a government contract to supply pens and paper?) Posted by: Evan at July 26, 2003 11:42 PM | PERMALINKJoshua - that whole thing about three sets of books is incredibly overhyped - the author obviously wasn't very familiar with databases and didn't recognize the use of a summary table, which used to be an extremely common technique for dealing with slow databases: rather than calculate something like the sum of 100,000 records each time I do something else which involves it, I can simply calculate it periodically or when the underlying data changes and reuse that. Almost every company in the world has code like this - I'm certain, for example, that your bank uses it - but the difference is that it's not used for something where accuracy is so critical. It's particularly annoying as this is largely no longer necessary for most applications - any skilled database developer could do real-time election stats for the entire country on my laptop and a real database. That's the real drawback to the conspiracist nattering started by that scoop.nz piece when it was making the rounds - people are claiming that this is some sort of attempt at election-rigging but there's no evidence to support that and I'm afraid all of the ham-handed spin efforts are going to lead many people to assume that this is just some partisan rant. What the evidence does clearly show is that every person involved with this systems from the original design process through implementation, the outside review boards and the purchasing groups are most charitably described as incompetent - I lean towards "gross negligence", personally. This would be like building a skyscraper while ignoring our last few thousand years of collective experience in making buildings and using novices for most of the work because they're cheaper - when it collapsed, people would be fired, the inspectors and officials who approved it would be brought up on charges of gross negligence and very few people involved again would ever work again in the field. (This isn't about their use of Microsoft software, either. I might quibble with that but competent engineers could produce much better results on any platforms simply because they understand this stuff and the Diebold team clearly does not - there are whole classes of attacks they didn't even know to consider) Posted by: Chris Adams at July 26, 2003 11:58 PM | PERMALINKSomewhat OT, but shouldn't it be simple to design voting machines which tallied "first choice -- second choice" etc., thus letting Nader or Buchanan supporters to vote their preferred candidate without having "wasted" their ballot? Posted by: Jeffrey Kramer at July 27, 2003 02:15 AM | PERMALINKMy last comment on this - a search in the comp.risks newsroup on Google Groups for "electronic voting" might be interesting. In particular - http://www.cs.uiowa.edu/~jones/voting/risks.html Posted by: Keith at July 27, 2003 07:05 AM | PERMALINKThe federal regulation 21 CFR Part 11 (the Electronic Signature and Records Act, passed in 1997) requires any FDA-regulated electronic data to install unique electronic signatures AND an audit trail. The thinking was to protect data submitted to the FDA by the pharmaceutical industry because they had a track record of fabricating or covering up results. The overlay technology exists. Of course, since Bush got elected, the FDA no longer inspects or enforces anything but self-reported data, but the technology is already there. Does anyone know why we can't apply it to voting machines? Posted by: Susan at July 27, 2003 07:24 AM | PERMALINK"Any even halfway competent programmer could scam the paper trail system in a heartbeat" Here are a few possible ways the scheme I presented above can fail: 1. The printer could fail (in some way), stopping voting at that
location or in that booth either just for one voter or for a longer time
period: 2. The user could fail to take, to verify, or to leave one copy of their voting. 3. Someone could tamper with the contents of the box. 4. Someone could tamper with the sampling of the contents of the box. The scheme outlined above uses the electronic machines fundamentally as printers. The paper ballots would control; if there's a discrepancy between the number of ballots cast, or the statistically sampled results, we'd know something had happened. Someone please tell me how this could be hacked, and how it's worse than horse-and-buggy voting. Posted by: Lonewacko at July 27, 2003 01:43 PM | PERMALINKThe paper controls? So what you're telling me, Whack, is that you've just proposed a really elaborate and expensive replacement for a ballpoint pen. Easy to program a machine to print one thing and calculate another, and still have the checksums come out correct. There was an extended discussion of this on several other blogs a couple of months ago. Every system someone proposed, someone else with more technical sophistication was able to describe a way to scam. Posted by: CN at July 27, 2003 04:15 PM | PERMALINKKevin (and others): Are you familiar with the Caltech-MIT Voting technology project? http://www.vote.caltech.edu/index.html You might have been exposed to it if you can recall what a Frog is in terms of electronic voting. Posted by: chris bond at July 27, 2003 04:40 PM | PERMALINKAll of this has been a remarkably interesting discussion; the end result has been to make me really question the wisdom of electronic voting, something I wasn't doing before. I will suggest that Lonewacko has it right in suggesting that if we must computerize, then we should demand generation of a printed copy. CN later questions this, asking if it doesn't negate the value of computerizing in the first place. I think the answer is this: Great Britain, with its old-fashioned paper ballots, is doing it the RIGHT way. But, it's also the SLOW way. What fun would that be for our media, which want to be able to report THE FINAL RESULTS early, early, early? The "Election Central" all-night report-a-thon is just too much fun, don't you know? Besides, this is America, durn it, and we've got to have everything fast ... including the results of the democratic process before our interest is drawn away to the next installment of Survivor. (Yes, I'm being sarcastic in all of this, and yet -- sadly -- I'm only a little over the top). Okay, here are the real reasons: computerization cuts costs, at least theoretically (because it takes fewer manhours to tally ballots), and it provides quick results. IF there is no tampering, the tally is very likely more accurate as well. All reasonably compelling reasons for computerized voting. So then what of CN's complaint? Well, if you think about it, you'll realize that you quite frequently encounter computers rigged to do just what Lonewacko (and I) argue for: generate a paper trail. Those would be the cash registers at the grocery and other retail stores. They do need to generate ONE printout of course (the receipt they give you), but these days many -- maybe most -- now include a second printroll as well. For those of us with a bit of training in accounting, the reason is obvious: "internal controls." You COULD depend on the computer to add up everything, and most of the time you do ... but just in case, you also want to have a printed version for audits. And the cost of this is very, very low (low enough not to offset the benefits of computerizing). As for having the system print different receipts, well, have them print in a window for the voter to watch (one goes onto the roll for audits, the other spits out to the voter). Again, regular, random audits of results would guarantee that any discrepencies would likely be caught, and in such cases the paper ballots prevail. (But, also again, this doesn't deal with many of the other problems mentioned in the Johns Hopkins study, or the other objections raised here ... problems that may not be so easily resolved. Which is why in the end I side with CN: give me a paper ballot, Scantron, or these nifty "mark sense" ballots Kevin refers to). Posted by: Marsman at July 27, 2003 07:27 PM | PERMALINK"Easy to program a machine to print one thing and calculate another, and still have the checksums come out correct." Let me repeat this: a sample of the physical ballots will be counted in the normal way. I.e., using the current procedure of vote counting with (supposedly) impartial observers. That is, if there are one hundred votes at a precinct, and Melrose Larry Green receives 60% of the electronic votes, and, after counting the physical ballots there are one hundred of them, and after counting the votes on twenty of the ballots 12 are for Larry, then everything's A-OK. "Every system someone proposed, someone else with more technical sophistication was able to describe a way to scam." I'm pretty technically sophisticated, yet I don't see a big problem with my proposal. Of course, there might be, but no one has come up with the details yet. Posted by: Lonewacko at July 27, 2003 09:36 PM | PERMALINKhttp://workersrighttovote.org The Georgia Debacle --- in plain English Posted by: Denis at July 28, 2003 09:35 AM | PERMALINKHere's another vote for optically-scanned paper over full-electronic ballots. I am an election judge in Dallas County, Texas, and the only problem
we've had with the optical scan ballots is, if you make a mistake
(overvote or wrong candidate), you're supposed to start over again with a
fresh ballot. If you have 30 races on the ballot, this obviously sucks
up a lot of time. (However, one can use whiteout to good effect,
although I am not allowed to do it at a voter's behest.) My principal objection to the full-electronic machines is that they're going to be carted around to the polling places by low-wage temps, who won't necessarily treat them with the respect that electronic machinery demands. As a result, I will spend the entire day having problems with the damned things, and when you're running a couple of thousand voters through in 12 hours, there is absolutely no time to fix anything that goes wrong. Further, the polling place setup is already complex enough without having to get a dozen machines working between 6 and 7 a.m. on election day. Posted by: precinct1233 at July 28, 2003 11:43 AM | PERMALINKGive what you have. To someone, it may be better than you dare to think. Posted by: Figueroa Grace at May 3, 2004 08:35 AM | PERMALINKonline casinos | casino bonus | casino directory | high roller casinos | casinos Posted by: doi at May 24, 2004 06:31 AM | PERMALINKBuy www.i-directv.net this it is a wonderful addition to anyones home entertainment system. Posted by: click here at May 27, 2004 11:10 PM | PERMALINKGet WWW.I-DISH-NETWORK.ORG rid of cable and upgrade your living room by clicking here! Posted by: satellite tv at June 3, 2004 10:19 AM | PERMALINKFind your www.ALL-FIORICET.COM here, 100% discrete! Posted by: click here at June 14, 2004 02:44 PM | PERMALINKgo to WWW.E-CREDIT-CARD-DEBT.COM for great deals! Posted by: click here at June 15, 2004 09:33 AM | PERMALINKHardcore Digital - Hardcore Maidens - Hentai Studios - Hirsute Honeys Posted by: Free sex sites at June 21, 2004 10:32 PM | PERMALINKNow you can Play Poker online any time! Posted by: online poker at June 25, 2004 09:26 AM | PERMALINKyou can play blackjack here! http://www.blackjack.greatnow.com Posted by: blackjack at July 21, 2004 06:42 PM | PERMALINK
you can play blackjack online here! If you've ever been curious about how to play online poker then you'll want to read over the following online poker guide. This guide you should be in a god position to play poker. Posted by: online casino at July 26, 2004 07:50 PM | PERMALINKIf you've ever been curious about how to play online poker then you'll want to read over the following. We suggest you try an online casino that offers free play in order to practice a bit before placing any real wagers. You can also play blackjack online fo free! Posted by: online casino at July 30, 2004 07:03 PM | PERMALINK8664 You can buy viagra from this site :http://www.ed.greatnow.com Posted by: Viagra at August 7, 2004 02:39 PM | PERMALINK5407 Why is Texas holdem so darn popular all the sudden? http://www.texas-holdem.greatnow.com Best XXX Sites - 7247 ok you can play online poker at this address : http://www.play-online-poker.greatnow.com Posted by: online poker at August 10, 2004 11:41 PM | PERMALINK5368 ok you can play online poker at this address : http://www.play-online-poker.greatnow.com Posted by: online poker at August 10, 2004 11:42 PM | PERMALINK7211 get cialis online from this site http://www.cialis.owns1.com Posted by: cialis at August 11, 2004 04:53 AM | PERMALINK2587 Keep it up! Try Viagra once and youll see. http://viagra.levitra-i.com Posted by: Viagra at August 14, 2004 05:57 AM | PERMALINK6759 Get your online poker fix at http://www.onlinepoker-dot.com Posted by: online poker at August 15, 2004 12:32 PM | PERMALINK5657 black jack is hot hot hot! get your blackjack at http://www.blackjack-dot.com Posted by: blackjack at August 16, 2004 03:34 PM | PERMALINK5813 so theres Krankenversicherung and then there is 6330 Its great to experiance the awesome power of debt consolidation so hury and consolidate debt through http://www.debtconsolidation.greatnow.com pronto Posted by: debt consolidation at August 18, 2004 11:07 PM | PERMALINK3396 http://www.exoticdvds.co.uk for 701 check out the hot blackjack at http://www.blackjack-p.com here you can play blackjack online all you want! So everyone ~SMURKLE~ Posted by: blackjack at August 23, 2004 03:35 AM | PERMALINK4251 Herie http://blaja.web-cialis.com is online for all your black jack needs. We also have your blackjack needs met as well ;-) Posted by: blackjack at August 24, 2004 07:44 PM | PERMALINK4299 check out http://texhold.levitra-i.com for texas hold em online action boodrow Posted by: texas hold em at August 26, 2004 01:31 PM | PERMALINK |
|
|
Powered by Movable Type 2.63 
|
||||
