17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS / Electronic Voting Session 2: Paper Trails Michael I. Shamos, Ph.D., J.D. Institute for Software Research International Carnegie Mellon University

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Student Projects Internet voting review Verifiability without paper Voter privacy assessment Code hiding –Can code be hidden undetectably? Alternative voting systems –ATM, lottery Secure software distribution –Assure that software inside voting machines is genuine Voting security standards –What should they look like?

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Why Do We Use Voting Machines? To prevent fraud –Lever machine (1892) “To protect mechanically the voter from rascaldom” Faster, more accurate counting

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Paper Ballots 1/27/ /29/1864

New York Times, April 4, 1855 BALLOT BOXES DESTROYED INJURIES IN RIOTS MORE BALLOTS CAST THAN NAMES ON THE POLL LIST

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Florida’s Solution “The ballots shall first be counted, and, if the number of ballots exceeds the number of persons who voted … the ballots shall be placed back into the box, and one of the inspectors shall publicly draw out and destroy unopened as many ballots as are equal to such excess.” F.S. § F.S. §

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Classical Voting Fraud Since 1851, the New York Times has published 4,744 articles on non-electronic voting fraud One every 12 DAYS for the past 150 years! The articles describe over 800 actual frauds One every 68 DAYS for the past 150 years

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS The Problem Voters do not trust DRE systems Why? –Numerous irregularities around the country –“Black box” phenomenon –Reports by computer security specialists –Warnings by computer scientists –Jurisdictions rushing to replace old systems –Secretive vendor behavior –Public awareness of computer vulnerabilities –Newspaper editorials, e.g. New York Times

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS The Problem Are DRE systems untrustworthy? –Some are, some aren’t DRE systems used for 25 years without a single verified incident of tampering –Much more difficult to alter computerized records than paper –Proprietary operating systems –Redundant encrypted memories –Testing None of this matters. Perception governs What to do?

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Statutory Requirements HAVA Sec. 301(a)(2)(i): “The voting system shall produce a permanent paper record with a manual audit capacity for such system.” Maryland Election Law 9-102(c): “Standards for certification.- The State Board may not certify a voting system unless the State Board determines that: (1) the voting system will: … (vi) be capable of creating a paper record of all votes cast in order that an audit trail is available in the event of a recount”

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Paper Trail Proposal Allow each voter to see her choices on paper before casting a vote If the choices are incorrect, they can be corrected The paper becomes the official ballot If there is a discrepancy between the paper record and the computer record, the paper governs Why? Because that’s the one the voter verified

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Paper Trail Advantages Demonstrates to the voter that the machine captured her choices correctly Creates a sense of security among voters

Paper Trail Disadvantages No guarantee vote was counted, will ever be counted or paper will be in existence if a recount is ordered Massive paper handling and security problem Slow counting –Sacramento experiment 06/04: took an average of 20 minutes per ballot to tabulate and verify results –Recounting California would take 450 years Accessibility issues Voter confusion –Must remember a lengthy ballot Machines questioned when nothing is wrong Increased demand for recounts Creates doubt among voters (CalTech-MIT Report)

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Voting Problems Machine won’t operate Machine fails during the election Intruder tampers with paper records –Stuffing, removal, alteration Machine captures choices incorrectly Intruder alters vote totals after election Machine maliciously or erroneously switches votes NOT ADDRESSED BY PAPER TRAIL SOLVED BY PAPER TRAIL DEPENDS ON PHYSICAL SECURITY OF PAPER TRAIL

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS AccuPoll Paper Trail SOURCE: ACCU-POLL

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Avante Vote-Trakker Paper Trail NJ Feb 26, 2001 President / Vice President GEORGE WASHINGTON, Andrew JACKSON US Senator John HANCOCK House of Representative Ben Franklin County Clerk JohnQuincy ADAMS Board of Chosen Freeholders Paul REVERE Board of Chosen Freeholders William HTAFT Board of Chosen Freeholders Theodore ROOSEVELT Public Question 1 Yes Public Question 2 No Public Question 3 Yes Thank you for voting! SOURCE: AVANTE

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Populex 1.Voter gets blank paper ballot, inserts in machine. 2.Voter removes touchscreen stylus. 3.Voter uses stylus to make selections on the touchscreen. NO INTERNAL COMPUTER RECORD OR COUNT, ONLY PAPER OUTPUT. 4.When voter is finished, machine prints a bar code and corresponding “punch” numbers which contain the voter’s selections on the paper ballot. 5.Voter verifies the ballot in privacy using a computerized read station. The voter then submits the ballot to an election judge to be counted. COUNTING IS BY BAR CODE. SOURCE: POPULEX

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Sequoia Paper Trail Nevada, Sept. 7, 2004 primary DEMO “A mechanical voting system must secure to the voter privacy and independence in the act of voting.” Nev. Rev. Stat. §293B.065

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Voter Verifiability Having each voter be able to verify that 1.her vote was understood by the machine 2.her vote was counted by the machine 3.her vote was counted as part of the final tally 4.no unauthorized votes were counted Paper trails provide (1), but not (2), (3) or (4) Systems exist that provide all four

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Paper Trails 2004 Will be used by Secretary of State mandate in –California –Missouri –Nevada Some other states require paper trails in future elections –Ohio, New Hampshire Let’s see what happens

17-803/ ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Q A &

Counting Punched Cards SOURCE: LOS ANGELES COUNTY