Election watchdogs keep wary eye on paperless e-voting systems

Voting systems that don't support a paper trail are hard to audit, Verified Voting says

As the clock winds down to what could turn out to be an extremely close presidential race, some election watchdogs are keeping a wary eye on paperless electronic voting machines that are scheduled to be used in several key states and jurisdictions around the country.

Paperless systems are basically Direct Recording Electronic systems (DREs) in which voters cast their ballots in a completely electronic fashion by using push buttons or touchscreens.

Some DREs allow voters to print out a paper copy of their ballots to verify that their vote was cast as intended. Election watchdog groups such as Verified Voting and Common Cause and academicians have insisted that such a voter verifiable paper audit trail (VVPAT) is vital to ensuring the integrity of the vote in jurisdictions that use DREs.

But a total of 16 states will, to varying extents, use DREs that do not support a paper trail as their standard polling place equipment, according to Verified Voting.

Of these, six states -- New Jersey, Delaware, Maryland, South Carolina, Georgia, and Louisiana -- will be completely paperless. All ballots that are cast in these states will be on DREs that support no paper trail whatsoever.

The remaining states, which include Texas, Colorado, Florida, Virginia and Pennsylvania, will use a mix of paper ballots and DRE voting systems that are paperless. But even here, the states of Virginia, Pennsylvania and Tennessee will be almost completely reliant on paperless electronic voting systems. In Tennessee for instance, all but two counties will use paperless DREs, while in Virginia all but seven of 134 countries will use paperless systems. Meanwhile, in a handful of states like Florida only voters with physical disabilities will use paperless DREs.

The extensive use of these systems in the upcoming elections is troubling, said Pamela Smith, the president of Verified Voting. Ideally, all jurisdictions around the country should be using voter-marked paper ballots and optical scanners for counting the votes, Smith said.

But if a DRE is being used, it should support a paper trail at the very minimum, she said. "There is a strong chance that a DRE system is working the way it should," she said. "The problem is there is no way to confirm that easily," she said.

Because there is no independent paper record of a vote, manual post election audits of paperless voting systems are impossible, she said. So if a paperless DRE system were to malfunction, record or count votes incorrectly, it would be very hard to verify the accuracy of the results, she said.

Election day mishaps involving DREs are not all that rare, according to a report earlier this year by Verified Voting.

In 2011, during the Democratic primary elections in New Jersey's Cumberland County, a paperless DRE system attributed votes to the wrong candidates and ended up declaring the actual losers as winners of the election. A new election was held later after the New Jersey attorney general acknowledged that the system had switched votes because it had been programmed incorrectly, the report said.

In 2004, a touchscreen DRE in North Carolina's Carteret County lost 4,500 votes due to a memory problem. Because there were no paper records, "it was impossible to determine how those lost votes should have been counted," the Verified Voting reported. Since then the state has moved to paper ballots, optical scanners and VVPAT-equipped DRE systems.

During primaries elections in May 2011, several voters in Pennsylvania's Venango County complained that their votes had been flipped from one party to another by the paperless DRE systems that were being used by the county. Similar complaints have been reported elsewhere. In some of the cases, election officials blamed the problem on screen calibration errors and programming errors.

"You can't do a post-election vote tabulation audit in such cases because there is no independent record of the votes," Smith said. "You are checking the system against itself. It is sort of a circular argument," she said. Even a few incorrectly counted or missing votes could make all the difference in a tight election especially if it happens in a key swing state, she said.

Thad Hall, an associate professor of political science at the University of Utah, said paperless DRE systems offer a degree of auditability, but not much.

"If you vote on a paperless DRE system, there are places within the machine that record the data," Hall said. "But if I don't trust the machine, I'm not going to trust the backup electronic records," said Hall, who was one of the authors of a recent MIT/Caltech report on e-voting technologies. "Sure they are auditable. The problem is that people are not going to believe the audit record," because it is not independent of the system.

Several states, including New Jersey and Maryland, have passed legislation mandating a move to paper ballots, but budget constraints have kept them on paperless DRE systems, Hall and Smith said.

But William Kelleher, CEO of The Internet Voting Research and Education Fund, said concerns about paperless DRE systems are overblown. "Just because the DREs have a "black box" in which votes are stored and tallied, doesn't mean the machines shouldn't be trusted," Kelleher said in an email. "We trust jet planes, which are at least just as much a black box," he said.

Machines may make rare counting errors if, for example, they are in need of recalibration, he said. "But humans make far more counting errors than the computers in the DREs. Perfection is not a standard that pragmatic people expect. Our election officials have determined that when the costs and benefits are balanced, paperless DREs present an acceptable risk."

Keyword: e-voting, electronic voting, paperless systems, voting systems, direct recording electronic systems, dre, verified voting, post election audit, Jaikumar vijayan

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed. His e-mail address is jvijayan@computerworld.com.

See more by Jaikumar Vijayan on Computerworld.com.

Read more about data security in Computerworld's Data Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags hardwaredata securitysecurityhardware systemsdata protection

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jaikumar Vijayan

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts