daniel
11-09-2002, 12:28 AM
http://www.salon.com/tech/feature/2002/11/05/voting_machines/index.html?x
Voting into the void
New touch-screen voting machines may look spiffy, but some experts say they
can't be trusted.
- - - - - - - - - - - -
By Farhad Manjoo* * * * * *
Nov. 5, 2002 | In mid-September, a few days after yet another
problem-ridden election in Florida, Rebecca Mercuri got a phone call from
Janet Reno. Mercuri, a computer science professor at Bryn Mawr, wasn't very
surprised to hear from the former attorney general; Reno had already been
declared the unofficial loser in Florida's Democratic gubernatorial primary,
and Mercuri, who during the past two years has become the country's fiercest
critic of electronic voting machines, has recently found herself
indispensable to losers.
A fast-talking, fact-toting woman who can recount dozens of stories of
voting machines going disastrously haywire, Mercuri goes into a region whose
election has been held up and proceeds to hold forth. Mercuri tells everyone
she can, from election judges to county supervisors to the local media, that
the supposedly "state-of-the-art" machines they've all been sold are nothing
but a "a bill of goods."
So far, Mercuri has had little success in convincing local leaders to slow
down their drive to purchase new voting machines. By late evening on
Election Day 2002, though, people other than electoral losers may start to
see some sense in Mercuri's arguments.
In the two years since Florida's first bungled election, dozens of local
municipalities -- and the entire state of Georgia -- have thrown out their
antiquated voting machines in favor of touch-screen, "ATM-style" systems.
According to some reports, more than 20 percent of voters will use such
machines this year, and that number is poised to increase during the next
decade. In October, without the slightest nod to the irony of the situation,
President Bush signed into law a sweeping new bill that promises to end the
voting problems that some say helped nudge him into office. The new law,
called the Help America Vote Act, will provide almost $4 billion to states
to allow them to purchase new machines.
But as Florida's Sept. 10 primary illustrated, the new systems are not a
panacea -- and, according to Mercuri and a growing number of tech-savvy
critics, the electronic systems are actually worse than their much-maligned
punch-card cousins. Mercuri's chief complaint with the touch-screen system
is that its inner workings are often a complete secret. When a voter touches
the screen to make a choice, there is no confirmation that the machine has
actually registered the correct selection. In the old punch-card and
fill-in-the-circle paper systems, voters can see their choice marked on
paper. And in the event of a recount, election officials can, as a last
resort, manually count those slips of paper. Since the new electronic
systems leave no paper trail, there's no chance of a recount.
"You can't recount a database," says Jason Kitcat, a computer scientist who
spent many years trying to develop an open-source Internet voting system.
"You can't audit electrons."
Despite these problems, local election officials -- the people who risk the
most embarrassment when an election goes awry -- are stampeding to buy the
new machines, often on terms that would not seem to be in their best
interest. Many officials agree to sign provisions with manufacturers that
protect the machines' inner workings as "trade secrets"; last March, in a
municipal election in Palm Beach County, Fla., the trade-secrets rules
prevented a candidate for the city council from inspecting machines that he
believed had malfunctioned during an election.
Why are the mechanics of the systems that are so critical to democracy being
kept hidden from public view? That's one of Rebecca Mercuri's main
questions. She argues for more transparency in procurement procedures, and
for the chance to have experts evaluate machines in the event that the
systems appear to misfire during an election. Perhaps if touch-screen
machines have problems on Tuesday, election officials will insist on those
procedures. (In some cases, though, it's possible that the machines will
malfunction and we may never find out about it.)
But Mercuri and other technologists also offer some harder-to-follow advice
to election officials: Don't buy new touch-screen machines at all, they say,
unless the machines produce some sort of auditable paper trail. When a voter
casts a ballot on a touch-screen machine, says Mercuri, the machine should
spit out a paper version of the selections, and this paper version should be
the "official" ballot, the one counted and used to determine the outcome of
the election.
Why paper over machines? It's an odd thing to hear in the Internet age, but
these technologists insist that marking data on dead trees, rather than
suspending choices in silicon, is the best way to ensure America's
democracy. Paper is bug-free, it can be made tamper-resistant, and it's
readable by most humans. It has a proven record. Mercuri, who, after all,
has a day job that requires her to be bullish on computers, says that
electronic systems simply aren't up to the job of voting. "The only thing
the computer is good for," she says, "is as a fancy ballot printer."
A good example of this blunt diagnosis was the situation that prompted Janet
Reno to call Mercuri in September. A few precincts in Broward and Miami-Dade
counties, both of which were using touch-screen machines purchased from
Election System & Software, an Omaha company that is the world's largest
provider of election equipment, were showing that nobody voted for the
governor's race, even though hundreds had turned out at the polls.
"She called me because they saw the numbers rolling out of the machines, and
they figured something was screwy," Mercuri says. "You would have places
where there were over 1,300 votes and there would be like one vote for
governor. It's like, Hello!?"
ES&S, which did not return Salon's calls for comment, moved quickly to see
what was wrong. According to press reports, the company said that its
machines had functioned properly, and that it was the workers at the polls
who'd had problems. Poll workers had apparently been instructed to insert
cartridges into the machines to collect votes at the end of the night, but
they did not do so, ES&S said, so it appeared that nobody had voted.
"I don't know what happened in every case. I just know [poll workers] had
procedures and didn't follow them," Willie Weslie, an ES&S program manager
told the Associated Press in September.
ES&S was able to get the votes from inside the machines, and it was during
this process that Reno's people called Mercuri. "ES&S does this thing called
'data extraction,' where apparently it takes like a couple of hours to get
the information from each machine," Mercuri said. "And Reno was asking me,
'What does this mean?' And, 'Can we get more data out, and more?'"
Reno's question wasn't really as opportunistic as it may sound. Even if
ES&S's procedure to recover lost votes was on the up-and-up, it had the
sheen of impropriety: A polling place initially records no votes, and then a
technician comes in, fiddles with the machine, and all of a sudden there are
some votes.
"Basically ES&S comes in and they've got some sort of tool they stick in
some part of the machine and they pull some data out of it," Mercuri said.
"How can you trust that?" What evidence is there to support the conclusion
that the second count, and not the first, is to be believed? Only the word
of the voting company. And Reno was (probably justifiably) not satisfied
with that.
Reno eventually conceded the primary election to Bill McBride, who,
according to the official tally, won by less than 5,000 votes out of more
than 1.3 million cast. But Mercuri remains suspicious of what really
happened in Florida. "We'll never know, will we?" she says.
It's a good question: If the result of an important election using
touch-screen machines ever comes into doubt -- as it could this year -- how
will we bring ourselves to believe in the results?
After Florida's 2000 election held up the presidential race, dozens of news
organizations spent months and millions of dollars to try to determine whom
the state had really chosen to be president. The investigators pored over
those famous dimpled chads and butterfly ballots in an attempt to determine
"voter intent." The results of this scrutiny, released a year later, showed
that Bush had probably won, though Al Gore might have had a chance had he
pressed for a statewide recount of ballots. Since the news was released
after Sept. 11, it did not seem to make much of a political difference, but
the study did at least provide a semi-official end to a lingering
controversy.
With an electronic system, such a tally may not even be possible. When you
vote on a touch-screen machine, the data is usually stored on several
different systems inside the machine -- a hard disk, a "smart card" and
perhaps other storage devices. The different systems serve to ensure that
the data cannot be lost, so that organizations seeking to do a recount could
possibly re-tally those devices. But those recounts won't get at a more
basic problem with electronic systems -- their accuracy. When you press the
button for Gore, how do you know that the smart card hidden deep inside the
machine is indeed increasing the count for Gore, and not for Bush?
Kathryn Ferguson, a spokeswoman for Sequoia Voting Systems, which recently
sold touch-screen machines to Palm Beach County, Fla., said that her
company's rigorous testing ensured that the voters' choices were correctly
recorded. In such a test, a predetermined set of votes are cast -- say, 500
Gore votes and 400 Bush votes -- and if the results show the same set, then
you know the system is tabulating correctly.
The system can't be tampered with between the test phase and the election,
Ferguson said, because it includes an "event log" that keeps track of
everything that's happened to the system.
"And I would ask," Ferguson said, "what did you know before, with older
machines? How did you know that those holes you punched in before were read
correctly? You didn't know with an optical-scan ballot, either, and you
especially didn't know with a paper ballot, because they're the least
accurate."
Ferguson is right, obviously -- we learned in Florida that you can't trust
punch-card readers, as they seemed to show new results each time they were
slipped through the counting machines.
But at least with those machines you had a piece of paper -- one that made
sense to human beings -- that could be studied after the election, Mercuri
counters. And the technical guts of punch-card and optical-scan systems are
much less complex than touch-screens systems, and are therefore less
vulnerable to hacks or bugs. When you doubt the results that come from a
touch-screen system, Mercuri says, the only way one can determine whether
the machine functioned properly is to open it up and test it. And often
that's not an option.
Last March, in city elections in Palm Beach, Emil Danciu, a one-time mayor
of Boca Raton, finished third in a four-way contest for two of Palm Beach's
city council seats. Danciu suggested that some of the votes cast for him had
been tallied to other candidates, and he sued for a chance to have the
machines inspected. Danciu hired Mercuri as a consultant, and she was able
to show county officials that Sequoia's system did seem to have some
problems -- for example, when a voter simultaneously touched the names of
two candidates, a third candidate's name was highlighted. (A Sequoia
representative told the Palm Beach Post that the demonstration was "silly"
and "ridiculous.")
Citing Sequoia's right to maintain its trade secrets, however, a judge
denied Danciu and Mercuri a chance to inspect the machines.
It was just this sort of outcome that Jason Kitcat had sought to avoid when,
as a computer science student in the U.K., he founded Gnu.FREE, a project
designed to build an open-source electronic voting system, one whose inner
workings were open for all to see.
"I thought that computers could provide a revolution in civilian affairs,"
he said, "but when I took a look at all the companies in voting, I couldn't
believe the state of affairs. Any technology out there was proprietary, and
the firms privately held, their finances were unclear, and their technology
was secret or protected by patents."
Kitcat spent three years trying to develop an open-source Internet voting
system, but the more he toiled, he says, the more he came to realize the
impossibility of the task at hand. And now, he says, "I've come to the
realization that electronic voting of any type -- even if it's open source
-- is a terrible, terrible idea. Very often, technology provides the
smokescreen to allow people to steal votes. If you look at the actual voting
process, the risks are humongous."
Kitcat and Mercuri are probably in the minority in their views on electronic
voting systems; after 2000's election, probably everyone would agree that we
need something better than punch cards to determine our elections.
But if 2002's touch-screen elections are challenged, local election
officials will likely start asking election companies to change their ways.
Already, some vendors say that if asked, they can configure their machines
to print out a paper ballot. And Ed Gerck, the CEO of Safevote, a company
trying to sell the world on voting via the Internet, says that he has
developed a way to "capture" the image of a screen of a touch machine --
which, if it works, would be an innovative way to provide a digital version
of a "paper trail."
On the other hand, if everything seems to go right this year, the drive to
buy touch-screen machines will likely increase, and little attention will be
paid to their possible faults.
"Weirdly, even though politicians live and die by elections," says Kitcat,
"they don't seem to be taking much interest between elections to make sure
they get these things right. They only worry about it when the chads are
hanging or they're pregnant, and when it's not going in their favor."
- - - - - - - - - - - -
About the writer
Farhad Manjoo is a staff writer for Salon Technology & Business.
Voting into the void
New touch-screen voting machines may look spiffy, but some experts say they
can't be trusted.
- - - - - - - - - - - -
By Farhad Manjoo* * * * * *
Nov. 5, 2002 | In mid-September, a few days after yet another
problem-ridden election in Florida, Rebecca Mercuri got a phone call from
Janet Reno. Mercuri, a computer science professor at Bryn Mawr, wasn't very
surprised to hear from the former attorney general; Reno had already been
declared the unofficial loser in Florida's Democratic gubernatorial primary,
and Mercuri, who during the past two years has become the country's fiercest
critic of electronic voting machines, has recently found herself
indispensable to losers.
A fast-talking, fact-toting woman who can recount dozens of stories of
voting machines going disastrously haywire, Mercuri goes into a region whose
election has been held up and proceeds to hold forth. Mercuri tells everyone
she can, from election judges to county supervisors to the local media, that
the supposedly "state-of-the-art" machines they've all been sold are nothing
but a "a bill of goods."
So far, Mercuri has had little success in convincing local leaders to slow
down their drive to purchase new voting machines. By late evening on
Election Day 2002, though, people other than electoral losers may start to
see some sense in Mercuri's arguments.
In the two years since Florida's first bungled election, dozens of local
municipalities -- and the entire state of Georgia -- have thrown out their
antiquated voting machines in favor of touch-screen, "ATM-style" systems.
According to some reports, more than 20 percent of voters will use such
machines this year, and that number is poised to increase during the next
decade. In October, without the slightest nod to the irony of the situation,
President Bush signed into law a sweeping new bill that promises to end the
voting problems that some say helped nudge him into office. The new law,
called the Help America Vote Act, will provide almost $4 billion to states
to allow them to purchase new machines.
But as Florida's Sept. 10 primary illustrated, the new systems are not a
panacea -- and, according to Mercuri and a growing number of tech-savvy
critics, the electronic systems are actually worse than their much-maligned
punch-card cousins. Mercuri's chief complaint with the touch-screen system
is that its inner workings are often a complete secret. When a voter touches
the screen to make a choice, there is no confirmation that the machine has
actually registered the correct selection. In the old punch-card and
fill-in-the-circle paper systems, voters can see their choice marked on
paper. And in the event of a recount, election officials can, as a last
resort, manually count those slips of paper. Since the new electronic
systems leave no paper trail, there's no chance of a recount.
"You can't recount a database," says Jason Kitcat, a computer scientist who
spent many years trying to develop an open-source Internet voting system.
"You can't audit electrons."
Despite these problems, local election officials -- the people who risk the
most embarrassment when an election goes awry -- are stampeding to buy the
new machines, often on terms that would not seem to be in their best
interest. Many officials agree to sign provisions with manufacturers that
protect the machines' inner workings as "trade secrets"; last March, in a
municipal election in Palm Beach County, Fla., the trade-secrets rules
prevented a candidate for the city council from inspecting machines that he
believed had malfunctioned during an election.
Why are the mechanics of the systems that are so critical to democracy being
kept hidden from public view? That's one of Rebecca Mercuri's main
questions. She argues for more transparency in procurement procedures, and
for the chance to have experts evaluate machines in the event that the
systems appear to misfire during an election. Perhaps if touch-screen
machines have problems on Tuesday, election officials will insist on those
procedures. (In some cases, though, it's possible that the machines will
malfunction and we may never find out about it.)
But Mercuri and other technologists also offer some harder-to-follow advice
to election officials: Don't buy new touch-screen machines at all, they say,
unless the machines produce some sort of auditable paper trail. When a voter
casts a ballot on a touch-screen machine, says Mercuri, the machine should
spit out a paper version of the selections, and this paper version should be
the "official" ballot, the one counted and used to determine the outcome of
the election.
Why paper over machines? It's an odd thing to hear in the Internet age, but
these technologists insist that marking data on dead trees, rather than
suspending choices in silicon, is the best way to ensure America's
democracy. Paper is bug-free, it can be made tamper-resistant, and it's
readable by most humans. It has a proven record. Mercuri, who, after all,
has a day job that requires her to be bullish on computers, says that
electronic systems simply aren't up to the job of voting. "The only thing
the computer is good for," she says, "is as a fancy ballot printer."
A good example of this blunt diagnosis was the situation that prompted Janet
Reno to call Mercuri in September. A few precincts in Broward and Miami-Dade
counties, both of which were using touch-screen machines purchased from
Election System & Software, an Omaha company that is the world's largest
provider of election equipment, were showing that nobody voted for the
governor's race, even though hundreds had turned out at the polls.
"She called me because they saw the numbers rolling out of the machines, and
they figured something was screwy," Mercuri says. "You would have places
where there were over 1,300 votes and there would be like one vote for
governor. It's like, Hello!?"
ES&S, which did not return Salon's calls for comment, moved quickly to see
what was wrong. According to press reports, the company said that its
machines had functioned properly, and that it was the workers at the polls
who'd had problems. Poll workers had apparently been instructed to insert
cartridges into the machines to collect votes at the end of the night, but
they did not do so, ES&S said, so it appeared that nobody had voted.
"I don't know what happened in every case. I just know [poll workers] had
procedures and didn't follow them," Willie Weslie, an ES&S program manager
told the Associated Press in September.
ES&S was able to get the votes from inside the machines, and it was during
this process that Reno's people called Mercuri. "ES&S does this thing called
'data extraction,' where apparently it takes like a couple of hours to get
the information from each machine," Mercuri said. "And Reno was asking me,
'What does this mean?' And, 'Can we get more data out, and more?'"
Reno's question wasn't really as opportunistic as it may sound. Even if
ES&S's procedure to recover lost votes was on the up-and-up, it had the
sheen of impropriety: A polling place initially records no votes, and then a
technician comes in, fiddles with the machine, and all of a sudden there are
some votes.
"Basically ES&S comes in and they've got some sort of tool they stick in
some part of the machine and they pull some data out of it," Mercuri said.
"How can you trust that?" What evidence is there to support the conclusion
that the second count, and not the first, is to be believed? Only the word
of the voting company. And Reno was (probably justifiably) not satisfied
with that.
Reno eventually conceded the primary election to Bill McBride, who,
according to the official tally, won by less than 5,000 votes out of more
than 1.3 million cast. But Mercuri remains suspicious of what really
happened in Florida. "We'll never know, will we?" she says.
It's a good question: If the result of an important election using
touch-screen machines ever comes into doubt -- as it could this year -- how
will we bring ourselves to believe in the results?
After Florida's 2000 election held up the presidential race, dozens of news
organizations spent months and millions of dollars to try to determine whom
the state had really chosen to be president. The investigators pored over
those famous dimpled chads and butterfly ballots in an attempt to determine
"voter intent." The results of this scrutiny, released a year later, showed
that Bush had probably won, though Al Gore might have had a chance had he
pressed for a statewide recount of ballots. Since the news was released
after Sept. 11, it did not seem to make much of a political difference, but
the study did at least provide a semi-official end to a lingering
controversy.
With an electronic system, such a tally may not even be possible. When you
vote on a touch-screen machine, the data is usually stored on several
different systems inside the machine -- a hard disk, a "smart card" and
perhaps other storage devices. The different systems serve to ensure that
the data cannot be lost, so that organizations seeking to do a recount could
possibly re-tally those devices. But those recounts won't get at a more
basic problem with electronic systems -- their accuracy. When you press the
button for Gore, how do you know that the smart card hidden deep inside the
machine is indeed increasing the count for Gore, and not for Bush?
Kathryn Ferguson, a spokeswoman for Sequoia Voting Systems, which recently
sold touch-screen machines to Palm Beach County, Fla., said that her
company's rigorous testing ensured that the voters' choices were correctly
recorded. In such a test, a predetermined set of votes are cast -- say, 500
Gore votes and 400 Bush votes -- and if the results show the same set, then
you know the system is tabulating correctly.
The system can't be tampered with between the test phase and the election,
Ferguson said, because it includes an "event log" that keeps track of
everything that's happened to the system.
"And I would ask," Ferguson said, "what did you know before, with older
machines? How did you know that those holes you punched in before were read
correctly? You didn't know with an optical-scan ballot, either, and you
especially didn't know with a paper ballot, because they're the least
accurate."
Ferguson is right, obviously -- we learned in Florida that you can't trust
punch-card readers, as they seemed to show new results each time they were
slipped through the counting machines.
But at least with those machines you had a piece of paper -- one that made
sense to human beings -- that could be studied after the election, Mercuri
counters. And the technical guts of punch-card and optical-scan systems are
much less complex than touch-screens systems, and are therefore less
vulnerable to hacks or bugs. When you doubt the results that come from a
touch-screen system, Mercuri says, the only way one can determine whether
the machine functioned properly is to open it up and test it. And often
that's not an option.
Last March, in city elections in Palm Beach, Emil Danciu, a one-time mayor
of Boca Raton, finished third in a four-way contest for two of Palm Beach's
city council seats. Danciu suggested that some of the votes cast for him had
been tallied to other candidates, and he sued for a chance to have the
machines inspected. Danciu hired Mercuri as a consultant, and she was able
to show county officials that Sequoia's system did seem to have some
problems -- for example, when a voter simultaneously touched the names of
two candidates, a third candidate's name was highlighted. (A Sequoia
representative told the Palm Beach Post that the demonstration was "silly"
and "ridiculous.")
Citing Sequoia's right to maintain its trade secrets, however, a judge
denied Danciu and Mercuri a chance to inspect the machines.
It was just this sort of outcome that Jason Kitcat had sought to avoid when,
as a computer science student in the U.K., he founded Gnu.FREE, a project
designed to build an open-source electronic voting system, one whose inner
workings were open for all to see.
"I thought that computers could provide a revolution in civilian affairs,"
he said, "but when I took a look at all the companies in voting, I couldn't
believe the state of affairs. Any technology out there was proprietary, and
the firms privately held, their finances were unclear, and their technology
was secret or protected by patents."
Kitcat spent three years trying to develop an open-source Internet voting
system, but the more he toiled, he says, the more he came to realize the
impossibility of the task at hand. And now, he says, "I've come to the
realization that electronic voting of any type -- even if it's open source
-- is a terrible, terrible idea. Very often, technology provides the
smokescreen to allow people to steal votes. If you look at the actual voting
process, the risks are humongous."
Kitcat and Mercuri are probably in the minority in their views on electronic
voting systems; after 2000's election, probably everyone would agree that we
need something better than punch cards to determine our elections.
But if 2002's touch-screen elections are challenged, local election
officials will likely start asking election companies to change their ways.
Already, some vendors say that if asked, they can configure their machines
to print out a paper ballot. And Ed Gerck, the CEO of Safevote, a company
trying to sell the world on voting via the Internet, says that he has
developed a way to "capture" the image of a screen of a touch machine --
which, if it works, would be an innovative way to provide a digital version
of a "paper trail."
On the other hand, if everything seems to go right this year, the drive to
buy touch-screen machines will likely increase, and little attention will be
paid to their possible faults.
"Weirdly, even though politicians live and die by elections," says Kitcat,
"they don't seem to be taking much interest between elections to make sure
they get these things right. They only worry about it when the chads are
hanging or they're pregnant, and when it's not going in their favor."
- - - - - - - - - - - -
About the writer
Farhad Manjoo is a staff writer for Salon Technology & Business.