ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Electronic Voting: The Technology of Democracy Michael I. Shamos, Ph.D., J.D. School of Computer Science Carnegie Mellon University

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Outline The voting process Voting system requirements Methods of voting Electronic voting Internet voting

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Voting System Certification Before voting equipment can be used or “offered for sale” in the U.S., it must be certified by a state (not the U.S. government) Certification procedures differ among the states Most require examination by a panel of examiners I was an examiner for –Pennsylvania ( , 2004-) –Texas ( ) –West Virginia (1982) –Delaware (1989) –Nevada (1995) Examined ~100 different voting systems 11% of U.S. population

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS The Voting Process 1.REGISTRATION –Voter must register in advance (so we know where she is authorized to vote) 2.IDENTIFICATION –Voter must identify herself at the polling place 3.PRESENT AND CAPTURE CHOICES –Voter must get correct ballot –Voter must be able to designate choices 4.TABULATION –Votes must be added up and reported correctly STEPS MUST BE SEPARATED TO PRESERVE BALLOT PRIVACY

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS The Six Commandments 1.Secrecy 2.Vote once, where and when authorized 3.No tampering; no vote-buying Implies no receipts 4.Accuracy 5.Reliability (system must operate through entire election) 6.Must maintain an audit trail, but can’t violate 1. “Complete physical record of each ballot cast” “Physical” does not mean paper From M. I. Shamos, Electronic Voting: Evaluating the Threat, Computers, Freedom & Privacy (1993)

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Complications Overvoting Undervoting Write-ins “Voter intent” Disabled voters (assistance?) Absentee voting (double envelopes) Spoiled ballots Challenged ballots Recounts

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Voting Risks Error –ballot setup –voter error Fraud –by political parties (registration of dead people) –by voters (multiple voting) Tampering –by manufacturer –by public (attack on voting machines) –by hacker

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Voting Risks Audit trail –Can we reconstruct the ballots if something goes wrong? Privacy –voter’s choices will be learned/revealed Tabulation –bugs, inaccuracy –tampering by officials Voter confidence –people don’t vote if they believe it will not make a difference

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Voting in the U.S. All 50 states are separate, use different voting methods. Americans vote for many different offices ONLY requirement: for President, all 50 must vote on the same day Voting in each state supervised by a state official Voting administration is by county, usually supervised by the county clerk –Number of counties in the US: 3142 Counties are divided into election districts (precincts) –Precincts supervised by volunteer election judges –Number of precincts: ~170,000 (about 60 per county) –Each precinct may have a different ballot

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS U.S. Methods of Voting (2000) Punched-card (32% of voters) Mark-sense (optical scan) (28%) Direct-recording electronic (DRE) (12%) Internet expanding Non-electronic: Lever machines (16%) Paper ballots (1%) Indeterminate: (11%) PUNCHED CARD OPTICAL LEVER DRE ? PAPER

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Paper (1%) Antique –Used in many very small counties –Requires manual counting –Easy fraud –Ballot stuffing –Invalidation SOURCE: TOMPKINS COUNTY, NYTOMPKINS COUNTY, NY X OVERVOTE CANCELS VOTE FOR MAYOR

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Lever Machines (16%) SOURCE: MICHIGAN SOSMICHIGAN SOS

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Lever Machines (16%) SOURCE: POLITICSNJ.COMPOLITICSNJ.COM

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Lever Machines Electromechanical, no computer, not “electronic” Very heavy, expensive, difficult to maintain No audit trail Advantages: –Overvoting impossible –Tampering difficult –Voter can readily revise choices –Captures voter intent –Easy to learn and use

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Punched-Card (32%)

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Votomatic Punched-Card System VOTING BOOTH BALLOT FRAME VOTING STYLUS BALLOT SEALS VOTING SETUP

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Counting Punched Cards SOURCE: NEW YORK TIMES

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Hanging Chad SOURCE: NEW YORK TIMES

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS LOS ANGELES COUNTY

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Punched Cards Very cheap Disadvantages –Worst system for voter – can’t even read his own choices –Easy to manipulate –Every time results are counted, vote is different –Doesn’t capture voter intent

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Mark Sense, Optical Scan (28%) TIMING MARKS START OF BALLOT

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Mark-Sense, Optical Scan (28%) Scanning methods –Visible light –Infrared Issues: –Dark/light marks –Some scanners require carbon-based ink –Voter intent may not be captured by machine Machine does not see what the human sees Easy to manipulate

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Direct-Recording Electronic (12%) SOURCE: SHOUP VOTING SOLUTIONSSHOUP VOTING SOLUTIONS DEMO

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Direct-Recording Electronic (12%) SOURCE: SHOUP VOTING SOLUTIONSSHOUP VOTING SOLUTIONS

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Touchscreen Voting (DRE) Hart InterCivic eSlate MicroVote Infinity Diebold

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS DRE Issues Is the software trustworthy? Is any amount of testing sufficient? Can the manufacturer influence an election? What happens if the machine is tampered with and there is no paper record? –Multiple encrypted backups on different media, ROM, hard disk, etc. DREs save been used successfully for over 20 years, with no evidence of tampering –Errors and other failures have occurred

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS

Internet Voting Each Election Day, approximately 5,000,000 Americans are outside the U.S. or stationed outside their home district Voting is difficult or impossible for them Idea: vote remotely using a browser 2000 Arizona Primary demodemo Issues: –registration –authentication –vote-buying –voter confidence

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Internet Voting Issues Digital divide: more convenient for people with computers Privacy Hacking Viruses and other malicious code Spoofed websites Denial of service Lack of receipts

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Project SERVE A worldwide Internet ballot delivery and management system NOT a tabulation system Designed for U.S. Department of Defense to allow military personnel to vote absentee Can be used by all Americans overseas Ballots are created and tabulated by local election jurisdictions (counties) Ballots are presented and delivered by Project SERVE

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Project SERVE Operation VOTER SERVE VOTER’S LOCAL 2. Voter signs up with Project SERVE by mail 3. Local sends ballot definitions and registration data to SERVE 4. Voter logs on to SERVE with browser to vote 8. Voter can check his Voting status anytime 5. SERVE presents voter with correct ballot 6. Voter votes 7. SERVE stores ballot so only local can read it 9. Local requests upload of its ballots 10. SERVE sends ballots to local without voter ID 11. Local counts ballots, announces results 1. Voter registers to vote (not on Internet)

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Project SERVE October, 2003 –SERVE Project Evaluation Group meets (10 members) January 2004 –4 group members opposed to Internet voting issue “Minority Report” February 2004 –Pentagon delays rollout of Project SERVE –5 million Americans who are eligible to vote in 2004 will not be able to vote February 2004 –Michigan presidential caucus successfully conducted on the Internet – 46,000 votes received

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Philosophical Issues Do we want direct, immediate public input on every political issue? Do we want immediate feedback from the public on everything the government does? Will government decision-making cease to be thoughtful and merely become responsive to public whim?

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Key Takeaways Voting is COMPLICATED Voting is UNUSUAL (compared to other computer applications) because there are no receipts Procedures and protocols are as important as the algorithms Security technology is complex and constantly changing Unknown relationship between privacy and verifiability in election systems Internet voting has great risks and great convenience

ELECTRONIC VOTING (HK) FEBRUARY 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Q A &