DHS plans urgently needed to address identified challenges before 2020 elections [pdf]

Hey, it sounds like you just came up with an excellent screening question for interviewing potential software developers for any project with security and/or privacy requirements.

"Do you think electronic voting is a good idea?" A "yes" answer would suggest strongly that the candidate does not have a deep understanding of software security and privacy issues.

All of this said, the convenience and accessibility of mail-in voting is extremely beneficial and so an ideal solution may be a hybrid arrangement in which voters have the option of mailing in their ballots or submitting them for immediate tabulation at a precinct or early polling location. This system actually exists in several states although the "mail-in option" tends to actually be an extension of absentee voting (basically, you are allowed to vote absentee by mail even if you just want your ballot sent to your own house inside of the jurisdiction), but awareness of the mail-in voting option could be significantly improved.

It is not efficient for the people voting. More than 1 election I simply skipped because I did not want to find my polling place, stand in line, and then vote

I want a Polling Place free Voting system

This is perhaps the #1 misunderstanding of electronic voting technology that I encounter and frustrates me endlessly: the most widely used electronic voting method in the US, precinct tabulators, are a paper-ballot based system. The only change from the "traditional" approach to voting in the US is that the OMR is moved from the county elections office to the precinct polling place, which simplifies handling of the paper ballots. The paper ballots remain the "source of truth" and are retained for audit, the machine just tabulates the ballots immediately after the voter turning them in, instead of a courier delivering the ballot box to the central office for tabulation. Precinct tabulators include multiple safeguards against tampering which are far from perfect but reasonably effective against most common attacks - ultimately the safeguard against tampering is the same as it always has been, that the ballot box must be kept under watch of sworn election officials to protect the integrity of the paper ballots. Exact handling of the ballot boxes vary by jurisdiction, in this state they are entrusted to the state court system for retention for several years and can be retrieved and opened for auditing by order of a judge.

Risk models for precinct tabulators are generally ballot stuffing, tampering with software in the supply chain, tampering with election configuration, or tampering with an individual OMR, such as in the polling place (this is by far the case that gets the most attention, even the security community seems to have largely not noticed the first three). Ballot stuffing is generally prevented by use of a machine "unlock" procedure (using a cryptographic token in the most common system) and review of the paper audit tape against the pollbook and/or voting permits generated by the pollbook (number of ballots on tape must match number of issued permits and the number of voters recorded as voted by the pollbook, these are independent checks in my jurisdiction although they should always be equivalent - checking both ways is actually a means of auditing the pollbook). Tampering with individual tabulators is relatively easily discovered by auditing the ballots using a different machine, which is the normal recount process in this jurisdiction. Tampering with tabulator configuration (likely by compromise of the election management system used to program the machines) can be detected by inspecting the paper audit tapes which include the machine configuration, which is normally conducted by a university political science department in this jurisdiction. This political science department also inspects the audit tape totals to audit the central office tabulation where the machine counts are added.

Tampering with tabulator software in the supply chain is by far the most difficult and concerning case. In every case I have ever seen, tabulators are never connected to the internet. However, they are connected to a configuration system which may be internet connected, and could offer a (not easy but possible) route to tampering with their software. It is more likely that such tampering would occur prior to delivery of the machine or perhaps during storage. If done carefully it could be very difficult to detect by any audit method except for a hand-count of ballots. In this jurisdiction and, according to NCSL in the majority of US states, a hand-count is performed on a subset of ballots as part of the normal post-election audit process, and should detect this type of tampering unless the effect is very small.

To be clear, some direct recording electronic or DRE machines are a major concern because there is no paper ballot for independent auditing. The term DRE can be confusing because some DREs produce a voter-verified paper audit trail or VVPAT which is essentially a machine-marked paper ballot which is shown to the voter prior to tabulation. These machines are considered DRE rather than precinct tabulators because they directly record the voter's preferences from the marker rather than scanning a paper ballot, however, because a paper ballot is retained they are mostly equivalent to precinct tabulators, with the downside that voters may not scrupulously verify the VVPAT since they were not required to mark it manually. Only about 28% of voters according to Pew vote using DRE machines, and according to Verified Voting about one quarter of those machines produce a VVPAT. This would suggest that about 21% of registered voters live in jurisdictions where there is no paper audit trail. This is definitely highly concerning, but is a significantly lower proportion of voters than most people who discuss this issue seem to think.

The popularity of DRE equipment increased significantly after the Help America Vote act because DRE machines contain significantly more advanced accessibility features (e.g. blind and mobility-impaired voter modes) and HAVA required jurisdictions to upgrade to machines with these features. However, HAVA does not require DRE at all. Jurisdictions which centrally count ballots or use precinct tabulators can offer voters with accessibility needs a "ballot marker" which they insert their ballot into. After assisting the voter, the machine marks their ballot and returns it to them, allowing them or an assister to verify the ballot's correctness. In my experience most disabled voters prefer to have a human such as a family member or sworn election official assist them in marking their ballot anyway, since it is easier than learning to use the machine's accessibility interface modes, but the ballot marking machine offers them the option of complete privacy. In the case of perhaps the most popular precinct tabulator, ImageCase, the ballot marker is the same machine as the tabulator to save space and equipment maintenance. In this case the machine returns the ballot to the voter after marking for inspection and the voter reinserts the ballot into the same machine for tabulation.

Focusing on all electronic voting methods, including precinct tabulation, as an evil, like a large portion of people in the tech community currently do, has significant downsides. Precinct tabulators, and OMR tabulation more generally, has significant advantages in terms of cost, accuracy (assuming no tampering, as in the majority of cases), and timeliness of results. Further, precinct tabulators have advantage to voters. Precinct tabulators generally sound an alert and return the ballot to the voter if there are problems tabulating it. This prevents votes being lost due to marking errors or damage to the ballot. Precinct tabulators confirm to the voter on a display that their ballot has been successfully tabulated, providing them with a higher level of confidence that their ballot will be counted than central tabulation provides.

This has been a very long comment, but this is a topic about which I am extremely passionate. Those involved in advocating for changes in the mechanics of the US election system must be sufficiently knowledgeable of the actual methods and machines in use to make reasoned arguments. This includes knowing the difference between precinct tabulation of paper ballots and DRE, and especially DRE with no VVPAT. Unfortunately it seems that most of the time they do not. It doesn't help that the media and even technical experts (although not technical experts in voting) regularly conflate OMR, precinct tabulation, and DRE, and generally contribute to an impression that the majority of US voters leave no paper trail even when that is untrue.

Were I president of the world, I would like to see legislation which mandates the use of a voter-marked paper ballot. This allows the significant advantages of precinct tabulators while ensuring the ability to audit the election by hand. I would further like to see legislation which requires that all jurisdictions hand-count a portion of ballots as an audit, possibly using the tiered method used in some states in which the size of the audit sample increases as the margin in a race gets smaller, eventually leading to a full hand count (this is essentially a more systematized version of the automatic recount legislation that already exists in many states).

This is somewhat complicated when many people are arguing against the use of any technology in the voting process, while unaware that technology (namely centralized OMR, which is essentially strictly inferior to precinct tabulators) has been in use since the '60s and widespread since far before the introduce of problematic DREs, and unaware of the controls in place to prevent and detect tampering with these systems. Electronic voting simply does not mean that there is no auditable paper ballot - in the strong majority of cases there is. Let's focus on the real problem, which is DRE with no VVPAT (with DRE in general being desirable to eliminate due to the limitations of VVPAT), and not cause election authorities to feel that they need to hold onto their unauditable DRE systems because the public acts like the only viable alternative is a full hand-count, which is prohibitively expensive by orders of magnitude to US elections authorities which generally suffer from severely limited funding.

Edit: besides fixing spelling, on a reread I realize that I should emphasize that precinct tabulators are connected to an election management system (which may be internet connected depending on the jurisdiction) prior to the election in order to program them. In some cases this is a direct network connection but more often it's a memory card that's moved from the election management system to the tabulator. They are not connected to anything during actual tabulation or at any time before the audit tapes and results card are removed. It is a sensible policy to require election management systems to be disconnected from the internet, and DHS has focused in on this issue closely in their work.

http://rbrua3v80lj2rulsf7iqfnpmf.wpengine.netdna-cdn.com/wp-...

Finally, there is the simple problem that the voter is not able to see their ballot tabulated "before their eyes," which is standard enough in most US jurisdictions that voters can get frustrated or worried if it isn't the case (e.g. due to a provisional ballot where the registration must be investigated before it can be tabulated, something that is thankfully becoming uncommon due to same-day voter registration). Once you're used to casting your ballot and "waiting for the ding and green light," it's a bit worrying to see it just stuffed in a canvas pouch.

This definitely isn't a problem that can't be overcome, but I think to some extent comes down to the culture of election administration, which is that everything must be absolutely correct to the individual ballot, and as much as possible should be done directly in the polling place (since that's where most of the independent observers/challengers/scrutineers are located).

Some of them even have compulsory national IDs, obviously that changes the dynamics of the situation entirely.

And they also don't have the 24th amendment.

I would bet the number of voters who are disenfranchised there is > 0

The GP has linked some well sourced articles about how voter ID laws have been used for primarily racist purposes in the US. Do you have any evidence that supports another narrative?

https://www.nytimes.com/2016/09/17/us/some-republicans-ackno...