NIST Condemns Paperless Electronic Voting 201
quizzicus writes "Paperless electronic voting machines 'cannot be made secure' [pdf] according to the National Institute of Standards and Technology (NIST). In the most sweeping condemnation of voting machines issued by any federal agency, NIST echoes what critics have been saying all along, that due to the lack of verifiability, 'a single programmer could rig a major election.' Rather than adding printers, though, NIST endorses the hand-marked optical-scan system as the most reliable."
because without a verifiable paper trail... (Score:5, Funny)
Re: (Score:2)
PS. what happened to the karma bonus?
Re: (Score:3, Funny)
Re:because without a verifiable paper trail... (Score:4, Insightful)
When a single programmer can steal the elections, it's because the electronic voting system is poorly designed.
Re:because without a verifiable paper trail... (Score:5, Insightful)
Elections can be stolen with paper ballot elections. However it is far more work to do so than with a fully electronic election. To steal a paper ballot election, especially if it isn't close, you would likely have to create a large number of fake ballots manually, and then selectively replace your victim's ballots. When there are many hundreds of thousands of ballots, this is a huge task, and cannot be done quickly. And to really cover your tracks you might want to shuffle the ballots, so they are not sorted by choice. Scrambling a deck of 52 cards is hard enough. Imagine hundreds of thousands of ballots. And of course all of these changes would have to match with the vote tallies. Any errors will be obvious, and could be considered evidence for voting fraud.
Contrast this with electronic paperless voting, where a single piece of software can replicate itself through many voting machines, as was shown possible [princeton.edu] by two Princeton professors. This code can then invisibly alter votes, and then eradicate itself after use. The fraud in this case would be undetectable.
Hand-marked is the way to go (Score:5, Interesting)
Old paper ballots were fine. (Score:2, Interesting)
Unfortunately, the idiots were too stupid to
Re: (Score:2)
Re: (Score:2)
I don't think it costs very much to design a ballot, unless you're Really Padding. In my state of Vermont, we use recycled paper for ballots which are marked by pencil and placed in a slot-top box. If the power goes out, we could count by lantern light.
Perhaps you've overlooked how government actually does work. W
Re: (Score:2)
Ummmm. No.
Nobody has ever suggested that electronic voting saves money or is even intended to. Costs related to designing and printing ballots are miniscule compared costs associated with electronic machines, including designing the electronic ballot (programmers are significantly more
Re: (Score:3, Interesting)
The parent answers the question from the end of TFA. It needs to be modded up:
Re:Old paper ballots were fine. (Score:5, Informative)
Re: (Score:2)
What happens when somebody votes for two people for one office by mistake, but leaves the next spot blank. Now you have arguments about which dot was meant for which line.
What happens when a circle has a little line in it, but not solid fill - was that a stray mark or an intended vote?
When an election comes down to 50 votes, you'll have endless debates over hundreds of "partial votes".
The advantage of a comp
Re: (Score:2)
I can see you've never actually used a mark-sense voting machine. I have.
What happens when somebody votes for two people for one office by mistake, but leaves the next spot blank. Now you have arguments about which dot was meant for which line.
Wrong. The voter sticks the filled-out paper ballot into the machine, and the machine beeps and spits it back out. Invalid, try again.
The advantage of a computer-generat
Re:Old paper ballots were fine. (Score:5, Interesting)
Do you actually understand what happened? Do you know how punch ballots work? "Shockingly simple" isn't even funny as a joke. You're given a ballot card with perforations that mark off squares. You're given a round pointy piece of metal. Instructions: Poke out a square hole with a round stick. "Hanging chads" are of course rampant, and for decades, they have been a known problem with a well-established solution for determining whether you voted or not: If the chad is hanging by only one or two corners, you voted whether or not the machine can read your vote. Cue the 2000 election, and Republicans whining about Gore's whining for a hand count for hanging chads. Cue retarded insults like yours that ignores the fact that hanging chads have been around for decades with an established procedure for dealing with them. Cue the supreme court canceling the recount, without any constitutional authority to tell Florida how to run an election or to demand Presidential election results on any particular day prior to the electoral college's ballot.
Re: (Score:3, Informative)
Several voters who lacked the most basic intelligence in comprehending the shockingly simple instructions on a paper ballot voted in Florida. These voters submitted flawed ballots that, for example, had hanging chads which should have been removed to clearly indicate which candidate should receive the vote.
Speaking as someone who actually voted in Palm Beach County in the 2000 election, as opposed to hearing about it on Fox News, that butterfly ballot was more than a little counterintuitive. The county had never used that design before, with the arrows pointing toward the center holes from both directions and the minor-party candidates' holes interspersed between the Democratic and GOP candidates.
Also, the way the punchcard and ballot booklet were loaded into the machine, the holes and the arrows didn't ex
Mod Parent Up! (Score:2)
Of course my mod points just ran out a couple of days ago...
Re: (Score:2)
More to the point, there is no need to protect a person from his own stupidity. If a person is so stupid that he cannot understand simple instructions, then his vote would likely not have been an informed vote: no vote is certainly better than an idiotic vote.
You're missing the problem. Consider two groups of people: idiots and non-idiots. .5% are idiots; 99.5% are non-idiots (all numbers made up). In both groups, 48.2% wanted Gore and 47.8% wanted Bush. However, idiots wanting to vote for Gore actually picked Buchanan. Net result, Gore lost .241% off his total, leaving 47.79%. Bush wins.
The problem wasn't that idiots couldn't figure out how to vote. That would have been fine. It's that Bush's idiots had less trouble voting than Gore's idiots. Either w
Re:Hand-marked is the way to go (Score:5, Informative)
One of the things they cover is about the manditory 3% or 4% recount to make sure they don't need a full recount. The problem lies in the fact that the ballots selected are not random. The law specifies that the 3% is "randomly self-selected" by the district/state elections clerk. This means that out of 10,000 ballots, they pick and choose 300-400 ballots to have public volunteers recount.
The public volunteers suspected that the ballots were picked specifically to match the final percentages so there would be no recount. Most of the ballots were grouped together by party lines as if they picked out a certain number of (R) ballots, a certain number of (D) ballots, and a certain number of (I) ballots but forgot to shuffle them together.
Re: (Score:2, Insightful)
Re: (Score:2)
One example is that the US federal system is part of the reason we don't have one unifying body that handles elections at the national level. Even within each state, counties/parishes are the
Re: (Score:2)
It may be possible to make a secure, paperless electronic voting machine.
But making a secure machine isn't the whole problem.
The problem is that even if you made a totally secure machine, there's no way to prove it actually is totally secure. All you'd know is you hadn't found a way to break it yet - a property all insecure machines have as well, until someone finds the vulnerability.
Re: (Score:2)
Re: (Score:2)
secondly, the bigger issue is physical security of the voting machines. no matter how simple or complex a
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:2)
These are ballots from primary elections. In most states, you can only vote in a primary for one party, hence you tell the election judge whether you want a Republican, Democrat, or Independent ballot. I haven't yet seen Hacking Democracy, but I understand that major parts of it are about the problems in the 2006 Ohio primary.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I think this really the key. Kind of compares to the idea that the appearance of impropriety is as bad as actual impropriety. A paper trail helps but there are an awful lot of people out there who just don't trust computers at all because they know that computers and their results can be manipulated. Their confidence in their own ability to fill out the ballot manually and drop it in a box certainly increases their confidence that their vote will be counted correctly...especial
Punchscan.org (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
Sleight Of Hand (Score:5, Insightful)
Re: (Score:3, Insightful)
Note: I'm not saying secure computer-assisted voted is impossible. Just that nothing remotely close has been invented yet.
Re: (Score:2)
I always said in philosophy class that free will is significant because no one can predict what I (or anyone else) will do... Kind of scary to think it has practical application.
Sheesh, I think the grandparent just proved electronic voting "can" be done securely.
MOD PARENT DOWN (Score:3, Insightful)
Ye
Moderation isn't for squeltching points of view (Score:5, Insightful)
"We" may have been over this before, but that doesn't mean you are correct, and it certainly doesn't mean you should be calling for people to be modded down just because you disagree with them.
Letting the voter verify that their vote was counted as cast, might, as you suggest, make vote buying easier. But it would also, as the GP points out, make stealing an election wholesale much harder. To make a rational choice between the two, you have to consider the relative risks, and doing so does not lead to the conclusion you're advocating. Even with receipts of some sort, vote buying is a very risky proposition, since by its very nature a lot of people would have to know about it before the election. If you want to buy ten thousand votes, at least ten thousand people will have to know about it, including who to vote for and what the payoff or threat is. If even a few of them blab, you're goose is cooked.
Conversely, without receipts, elections can be stolen by a small group of people with no witnesses except for the machines, and they can steal as many votes as they want--a million isn't that much harder than a dozen.
--MarkusQ
Re:Moderation isn't for squeltching points of view (Score:2)
And if I may reply here to everyone excluding the parent, why all these "vote buying" and "how do you guarantee..." arguments against my statement? So I'll take you to collectively mean you advocate the root of this thread? Yet another piece of perhaps-slightly-harder-to-corrupt technology?
Look closely at what the Profit Makers are offering. Why is that better than a publicly verifiable list? Better for whom? Do you hold shares
Re:Moderation isn't for squeltching points of view (Score:2)
It does perhaps say something about the grandparent poster though.
The "vote-buying" fear is an odd and irrational one, as you point out. An election is a many-to-few application (well, sort of); are the non-elected or elected going to micro-punish those who didn't vote for them?
Re:Moderation isn't for squeltching points of view (Score:2)
The legitimacy of the system can be "nickle and dimed" in a significant way from pressures such as that. (Replacing boss with parents, or mobsters, or friends, or whatever is appropriate.) Part of the perk of not allowing any possible
No. You're wrong. (Score:2)
Please do basic research before making statements like this in the future.
(Why, yes, I am an NSF [nsf.gov]-funded voting security [accurate-voting.org] researcher. Obligat
Re: (Score:3)
Even then, how do you verify? Go back and ask every single person who they voted for, and compare against the list? How would you know that the recounting process will be more accurate and tamper-proof than the original election?
Nothing is 100% accurate or 100% verifiable. The best you can hope for is a result where the difference is larger than your estimated margin of error, and then you can feel pretty sure. Even then, you have to just hope that human affairs are not so important or delicate that an
Re: (Score:3, Insightful)
A tiny bit of fuding the numbers, and you have 5% of votes from people who only exist on paper...
They certainly aren't going to come forward and say that their votes weren't counted correctly...
And no ID verification to boot (at least in MD) (Score:4, Insightful)
Re: (Score:2, Informative)
Re: (Score:2)
Anyone who advocates not having to show ID to vote has another agenda.
Take a real close look at the types of activist groups who cry out the loudest whenever someone floats the "show an ID" concept.
Re: (Score:2)
And I think it's just sad that there are so many people like you out there (on either side of the political spectrum) that just dismiss the arguments of those who disagree with you as the biased ramblings of "activist groups" without considering that they might actually have a point. Or do you think it's okay to
Let's see your PAPERS! (Score:2)
Oh, right you're probably thinking "any form of government issued photo ID". Well I'm thinking bullshit. Your driver's license is to operate a motor vehicle, your health card (in Canada) is for presentation at a hospital when receiving medical services, and your Passport is required by foreign governments, not your own. Therefore, either you have to be a licensed driver, have a state run medical plan, or interest
Re: (Score:2)
Not as long as the state is required to issue photo ID for free. As you know, in the US at least there can't be any cost to voting.
And in a timely manner. In states like mine with same-day registration, that would mean, while you wait. At the polling place.
Forget it. States 1) don't have the required level of competence, and 2) are too cheap.
Re: (Score:2)
Um... To aggravate people like you? Believe me, that has far more effect on my long-term health prospects than whether I get an immediate transfusion in some hypothetical scenario that'll never happen.
Note: Whenever I take my life in my hands by driving, I *do* bring ID. It also happens to be required by law...
Re: (Score:2)
Yep, that's who I was talking about.
just for the possibility of getting to tell someone who doesn't have that right to blow off.
You can get in a pretty complicated legal situation if you don't hand over ID you've got in your pocket. If you left it at home, things are a lot simpler.
Note: I'm not advocating being rude to cops. However, that doesn't make it ok to sit around and watch people's freedo
I agree (Score:5, Interesting)
It is a stupid system, and I am proud that someone with more authority than me is saying so. I believe all the politicians who decided that touch screen voting was a "great idea" should be voted out of office ASAP.
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:2)
There's multiple ways to get it "right" - these include paper "receipts" that the voter can check & put in a ballot box (available for recount) or optical scanned ballot papers printed by the computer, but ultimately, it gives a physical check in the voter's hands to confirm that they are voting for who they believe they are voting for
Re: (Score:2)
Because an ATM is designed to 1) identify and authenticate a user; 2) retrieve an authenticated user's account information over a network; 3) record a transaction that is identifiable and verifiable, and that connects a user to an acc
Direct Democracy (Score:4, Insightful)
Representative for hire (Score:2)
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Re:Direct Democracy (Score:5, Insightful)
Politics and governance is no different. Specializing is a good thing, and representative democracy allows people to specialize in governance. We don't even let generalist physicians do surgery, let alone the average layperson. It's too complicated, and too important... so we give the job to a specialist. Same with government. We could let the average person make decisions about long term taxes, economic growth, foreign policy, and the like, but I think it's too complicated.
I'm in California, and we've got more direct democracy than pretty much any other state in the union. And every election we're bombarded with propositions. No one really bothers to read the text of the summaries, let alone the actual text of the proposed legislation. So people vote based on their instincts, the television ads, and what their friends tell them. These aren't well-considered or thought out reasons... just the reasons that people have time for. I try my best to wade through them, but I've got a job and a family, and there often just isn't the time.
If you've got the time to keep up with all the information that *should* go into making these decisions, more power to you. But I think that the vast majority of the population doesn't have the time, interest, or education to do the same.
Re: (Score:2)
Duuuuuuuupe (Score:2)
Re: (Score:2)
This link works.
NOT a dupe (Score:2)
THIS article is based on the actual release, and what the release actually says.
Eh? (Score:2)
"secure"... depends who you're talking to. (Score:2)
Oh, they can be made secure. They can be made to secure the election for whomever you want. That's the whole idea.
Maryland (Score:2)
Savages... (Score:2)
Re: (Score:2)
Because trees don't believe in democratic elections.
Why trust the scanner? (Score:2)
If the scanner is hooked up to a crooked counting algorithm, how will you know unless you actually count the paper? If you have to count the paper to ensure that the scanner is honest, why bother with the scanner at all?
Re: (Score:2)
Because the human-marked and machine-scanned ballots go into a ballot box for potential counting later.
If the scanner is hooked up to a crooked counting algorithm, how will you know unless you actually count the paper?
If there is a question you actually DO count the ballots. And you count ballots in a few randomly-selected precincts even if there ISN'T a question, just to keep watch.
If you have to count the paper to ensure that the scanner is
NIST also condemned current paper trails! (Score:4, Informative)
"The NIST is also going to recommend changes to the design of machines equipped with paper rolls that provide audit trails.
Currently, the paper rolls produce records that are illegible or otherwise unusable, and NIST is recommending that "paper rolls should not be used in new voting systems."
via http://www.bradblog.com/?p=3860#more-3860 [bradblog.com]
We really should just use optical scan ballots. That is a paper trail voters have to verify, and the ballots can be meaningfully recounted. Then Diebold and the other vendors should be sued for knowingly selling defective products--possibly fraudulently.
Re:NIST also condemned current paper trails! (Score:4, Informative)
If found quickly enough, a faded thermal paper can still be read accurately with specialized equipment, but it is not a simple matter and is completely ineffective after an extended period.
I know this because of a horse race -- I left the track before a race, had a winning ticket (printed on thermal paper), and had it fade on me either because it sat in direct sunlight or because it was in my pocket, either of which exposed it to enough heat to render it unreadable to a person. I wasn't too hopeful about redeeming it, but I explained the situation the next time I was at the track, two weeks later. They managed to read the ticket (and pay me my $8 on a $2 bet) but needed a special reader to do so. They also explained that given another month or two they wouldn't be able to read it.
The point is that any given election official who next summer checks the DRE paper trails from the November election may just find a cabinet full of blank rolls. Unreadable in less that half the time that Federal law requires the records be kept. This is a big problem.
Verifiability? (Score:2)
Wow, just when Domecrats win (Score:4, Interesting)
Whatever, it's the right thing to do, finally.
Re: (Score:3, Interesting)
This federal study is a wee bit late (Score:2)
What a c
I Knew It! (Score:2, Funny)
I knew there had to be a reason the Democrats won congress! Hopefully they'll have this fixed by 2008!
Optical scanning offers significant benefits (Score:4, Insightful)
2 - Inexpensive scaling. Since you mark on paper the polling station can have 20 booths for people which are not much more than a table, curtain, and a pen; yet they can share one or two optical scanners. Touch screen systems require one expensive machine per booth.
Do the math. 20 expensive touch screen machines per polling station, versus 2 less expensive optical scanners.
This cost savings could be used in urban areas where there traditionally have not been enough resources for the election.
3 - Trustable. Any dispute can be settled by the actual piece of paper I wrote on. Optical scanners are based on technology used by schools to grade for decades and require little more than a motor, light sensor, and a very low end CPU. There is little to go wrong and very little which can hide tricks.
4 - Easy to use. I take a pen and fill in a box. Touch screen systems appear to suffer serious "alignment" issues which can cause votes to be mis-registered and which require frequent realignment in the field.
5 - Robust. There is no screen to be scratched, or broken. The voter never interacts with the scanner except to slide a piece of paper into it. There is no printer to jam, or foul, or have other issues.
Re: (Score:2)
The paper can tear, the marks can be incomplete, the building could burn down. A properly engineered mature design will not "break." Think about 5-function calculators... do they crash? Do they give incorrect answers? No. All they need is power, and they work flawlessly, cheap-o stamped-out-of-plastic-in-China-for-three-cents-a- unit issues
Re: (Score:2)
The big advantage of computers is input validation. And you could still h
My Ideal Solution (Score:2)
What I'd ideally like is a terminal that you could either use as a touch screen to cast your votes, or feed an optical scan ballot into.
Why use it with an optical scan ballot? There's always part of me that nags at me, wondering if "they" are going to correctly interpret my vote when they scan it in. This way, when the terminal scans it, it can show me what it gleaned from my markings, and if it comes up wrong, I can either issue corrections there (which are specially marked as such on the ballot), or
a couple of months late, gents. (Score:2)
http://vote.nist.gov/DraftWhitePaperOnSIinVVSG2007 -20061120.pdf
Election's over, gents. This would have been much, much more helpful more than 12 months before the election...
One does wonder if the report was held until after the election on purpose- possibly to avoid cuts in funding and such under the then-Republican-majority Congress?
A multi tier system is best (Score:2)
Second an electronic paper reciept given out to a voter that kind of looks like the bar codes on a lotto ticket. Second an optional electric reciept, with both a physical or wireless connection to record another kind of coded data.
The one major requirement of the syste
From a reliable source (Score:2)
Paperless electronic voting machines 'cannot be made secure' [pdf] according to the National Institute of Standards and Technology (NIST)
This conclusion brought to you by the same people who commissioned and instituted the AES encryption standard.
If they say paperless electronic voting can't be made secure, I'd believe 'em!
2 paper trails (Score:2)
the 1st trail is to take home. the 2nd, duplicate receipt is to drop in a manual recount box. the receipts say plainly who you voted for, so you can protest if you like (and a key
This year (Score:2)
Re: (Score:2)
I'd suggest you look at the Hacking the Vote movie that was on HBO.
A view of US elections from the rest of the world. (Score:2)
In my country, New Zealand, the turnout usually approaches 80 to 90 percent and every ballot has an obscured serial number and a counter-foil with the voter's roll number written on it by the poll clerk. OK, it's not a completely secret poll, but revealin
Instant runoff voting (Score:3, Interesting)
What ballot system would support instant runoff voting? That's the method in which the voter ranks candidates and then, if no candidate attains a majority, the least popular candidates are eliminated and the voters' second choices counted [1 [instantrunoff.com],2 [wikipedia.org]]. It prevents third parties from spoiling elections, like Ralph Nader was accused of taking votes from Al Gore in 2000 or Ross Perot from George Bush in 1992.
With instant runoff voting, it's safe to vote for third parties since you can choose a major party as your second choice. I think the emergence of viable third parties would really improve politics and governance.
But how do you actually collect appropriate ballots? I don't know of a simple way that "connect the arrow" paper ballots would work. One of the advantages of electronic ballots is that they could theoretical handle instant runoff voting elegantly. However, I doubt that the electronic voting system manufacturers are designing for that ability, especially since they seem to be funded by the two major parties.
AlpineR
Machines bad until Democrats win (Score:2, Insightful)
Anyone?
Anyone?
[crickets]
Re: (Score:2)
As to "one programmer" have you read Ken Thompson's thoughts on trusting trust [acm.org]? Okay. So maybe it's got to be a *smart* programmer. One guy can certainly do it.
I call bull puckey (Score:3, Insightful)
I call bull puckey.
The potential for corruption is massively greater when THERE IS NO WAY TO CHECK FOR IT.
When it can be detected (and is routinely watched for), trying to rig an election stops being a path to power and becomes a path to jail.
Re: (Score:2)
Because all machines are coded by a single person with no error-checking or internal oversight by other members of the machine's design team, yes, sir.
Errr.. have you SEEN actual software development take place before? I have, and error checking and internal oversight by others is the exception, not the rule. I sure as hell wouldn't want elections entrusted to companies that're always on the lookout to reduce costs.
The long and short of the issue is that the potential for corruption is identical for pape
Re: (Score:2, Interesting)
Touch screen requires a complex GUI level machine with hundreds of thousands or even millions of lines of code. Even if the code is "open source" there is still that complexity there. Stuff to go wrong.
Some systems have no paper trail. Open source does not change this.
One machine per voting booth solutions are VERY expensive. Optical ballot systems allow my booth to be a curtain, pen, and tabl
Re:Electronic Voting (Score:5, Informative)
I have a job reviewing the software that runs the elections. As a result I have several of the packages in question on my machine. The auditing I do has nothing to do with the election security. It is technical. None the less; I have looked at the security issue. I agree with the critics entirely. Electronic Voting without a proper paper trail is a sucking security hole. The Diebold software has several leaks in it including USB drive access. I have reviewed on package I would trust and it does use a paper trail. In general the critics of this methodology of voting without paper trails are more than correct.
Any election even with a paper trail, should have several other controls built in. The development of regionally accessible voting is a good step. This is where you can vote anywhere the election is being held. It makes stuffing boxes kind of hard. Another method needs to be 3 way tally. The voting totals need to be local, reported to a regional and to a central authority and the results compared. The paper ballots should automatically be recounted by machine and a certain number of them sampled for hand recount. The custody of the paper ballots should be under ARMED WITNESSED GUARD at a central location such as the State Agency. It should not be under the control of local officials. In general the election oversight agency of a State should be most carefully constructed with agents who are not subject to political whim for employment.
I have worked as an election official in the past. The number one concern of any citizen in an election should be that the election tally's and results are properly handled. A Former County Commissioner from my district was wrongly not certified for election because of probate Judge who was dishonest and it took a federal suit to over turn his ruling. He was placed in office about 13 months late after the hack the judge certified wrongly had pretty well looted the office. Election stealing is a very real issue and one of the highest concern for people with an elected government. In the election in question, the Probate Judge certified a box as valid when it had 1100 more votes (all cast were for one candidate) cast than the box had voters.
I cannot emphasize enough that any machine voting system that does not track with a proper receipt system and with other major controls is simply a machine to steal elections more efficiently. Such a system makes stealing easy and removes all evidence that it was stolen.
Re: (Score:3, Informative)
Actually, there's another problem with paper trails that nobody seems to have yet picked up on. Federal law requires voting records, including paper trails, be kept for 22 months. But most of the ballot printers on the DRE machines use thermal paper rolls for the paper trail. The printing will degrade on these after