December 26, 2006

Undo Electronic Voting

By Tom R. Halfhill

Electronic voting machines are a classic example of botching a high-tech solution to a low-tech problem, thereby creating a new high-tech problem. It might be amusing if anything less than our democracy were at stake.

U.S. election authorities are rushing into electronic voting without due diligence, without carefully considering the consequences, and without sufficient input from technical experts. Indeed, the situation is so appalling that I suspect almost any reader of Microprocessor Report could design better hardware and software than we have now. We don't really need electronic voting machines, but if we're forced to use them, let's at least do it right.

Since the U.S. midterm elections on November 7, worries about paperless electronic voting have prompted some jurisdictions to seriously consider abandoning the machines or requiring verifiable paper trails. That's a good sign. Currently, five states rely on paperless machines exclusively, and 11 other states plus the District of Columbia use paperless machines in some locales.

Unfortunately, in early December, the U.S. Elections Assistance Commission—which was created by the Help America Vote Act following the 2000 election snafu—rejected a proposal to recommend paper trails everywhere. The commission didn't react kindly to a draft report from the National Institute of Standards and Technology (NIST), whose staff advised the commission that paperless voting cannot be made secure.

Commission members who didn't heed the NIST report said that discarding or modifying paperless machines would be too costly. It's strange that cost should become a decisive issue now, after states have spent millions of dollars buying paperless machines whose flaws were identified years ago.

Some people view the largely grassroots campaign against electronic voting as hysterical Luddite nonsense. To others, it's perhaps our last chance to save the integrity of U.S. democracy from a reckless abuse of computer technology. After six years of quietly following this controversy, and after using a newfangled voting machine for the first time last month, I now count myself in the latter group.

Paperless Voting Creates New Problems

Like other skeptics of electronic voting, I have several objections. Some voting machines are poorly designed, even flouting user-interface principles that programmers have followed for more than 20 years. The machines are expensive, severely limiting the number of voting booths at each polling place and causing long lines that deter voters. Poorly trained poll workers can't boot the machines on election morning, can't fix problems that occur during the day, can't help voters operate the machines, and don't understand the need for physical security to protect the machines against tampering.

Another objection is that only four private companies make the electronic voting machines that already count 80% of the ballots in U.S. elections—and at times these companies behave as if the American people work for them, instead of vice versa. When the state of California ruled that voting machines must keep a paper record, one company complained that the mandate was too difficult. You would think that the state had demanded the construction of a cold-fusion reactor.

Partisanship is another danger. The CEO of one voting-machine company was a major supporter of a presidential candidate during the 2004 campaign, even hosting a $1,000-a-plate fund-raising dinner at his mansion for the candidate's political party. At the same time, his company was lobbying to sell electronic voting machines to the same state, whose chief election official belonged to the same party. In another state, a U.S. senator was a part owner and former CEO of a voting-machine company that counted his own votes. Even if no chicanery is going on, the appearance of a conflict of interest is disturbing.

The secrecy is disturbing, too. Voting-machine companies jealously guard their source code, claiming to protect proprietary trade secrets. In effect, our government is privatizing and outsourcing our elections according to rules and procedures hidden from the public. Meaningful audits and recounts are impossible without paper trails, so we're forced to bet our democracy on the accuracy and integrity of secret software. Whatever happened to checks and balances? And since when is it a trade secret to display names on a video screen and increment variables in response to user input?

Electronic voting machines are an attractive target for malicious hackers. We can't make hacker-proof PCs, but for some reason, we gamble the integrity of elections on voting machines that get much less real-world testing. Of course, paper ballots can be manipulated, too, but altering enough ballots to tilt an election isn't easy, and the false ballots are themselves an audit trail. Tampering with electronic voting machines in a few key precincts can automatically steal thousands of votes, leaving no audit trail. Elections should be decided by which candidate gets the most votes, not by which candidate has the best hackers.

Unfortunately, election boards and state governments are filled with nontechnical people who are easily dazzled by PowerPoint pitches. They seem to think that electronic voting is automatically better than other methods, just because a computer is involved. A similar delusion about technology was apparent after the 2000 presidential election, when a politician declared that Florida's punch-card results must be reliable because "machines can't be biased."

Of course, he was wrong. As any engineer knows, machines can be anything they are designed to be. But, more to the point, the politician didn't understand technology or arithmetic. In the 2000 election controversy, the technical issue was precision, not bias. Florida used punch-card machines with a raw error rate of 3.5% to measure a difference of 0.009%. Arithmetic isn't Republican or Democratic. Electronic voting creates a false faith in technology as an irreproachable solution.

My Experience With Electronic Voting

Since I began voting in the 1970s, I have lived in several different cities and states, and I have used almost every common voting method: old-fashioned pen-and-paper ballots, Votomatic punch cards, lever-actuated mechanical voting machines, and optically scanned paper ballots. On November 7, I had the option of voting with the usual optical-scan ballot or a brand-new electronic voting machine. (My county in Northern California is gradually adopting the new machines.) In the interest of research, I gave the electronic machine a try.

Keep in mind that I'm not a computerphobic Luddite. I'm a technology analyst for Microprocessor Report who has been using computers for 30 years and writing about them for 25 years. I have been programming computers since 1980 and have written software that records and tabulates votes for a contest on the Internet. Yet right away, I was taken aback when the poll worker thrust a large instruction manual into my hands and issued the only verbal direction I was to receive: "Oh, it's not a touch screen."

This particular voting machine was a Hart InterCivic eSlate. Instead of using a touch screen, voters spin a control wheel clockwise or counterclockwise to highlight various elements on the screen. The eSlate control wheel operates somewhat like the click wheel on an Apple iPod, except it's a real wheel, not a virtual wheel, and you can't click it. There's a separate Enter button for indicating choices, as well as arrow buttons for paging the screens forward or backward.

I adapted to the control wheel pretty quickly. But then, I have lots of experience with user interfaces. I wondered how people who have never used an iPod would fare. Maybe the eSlate control wheel comfortably reminds older folks of a rotary-dial telephone—the only other consumer appliance I can recall that has a vaguely similar input device.

My next surprise came only moments later, when I discovered that the control wheel let me select elements on the screen for which no actions were permitted. For example, to vote in the first contest, I thought I was supposed to select the category heading and press the Enter button. Nope. The button had no effect there. Instead, I was supposed to spin the control wheel to highlight my selected candidate, then press the Enter button to indicate my choice.

Ideally, the control wheel should skip everything irrelevant on the screen (such as the category headers), just as some options on a PC screen or menu are grayed out when irrelevant. But I must admit I didn't read the instruction manual before voting. I don't think an instruction manual should be necessary for someone who has more than 30 years' experience with voting and with computers.

User Interface Is Inconsistent

Moments later came my third surprise. Contrary to widely accepted user-interface principles, selecting the last candidate on a particular screen automatically flipped to the next screen. That's a definite no-no, for two reasons.

First, the graphical user-interface (GUI) widgets that programmers call check boxes should merely allow users to choose among multiple options; they shouldn't initiate actions. Command buttons are for initiating actions. Second, the eSlate's behavior is inconsistent; the only check box that initiates an action is the check box for the last contest on the screen. Voters who choose not to vote in that contest must press the right-arrow button to advance to the next screen. GUI widgets should behave consistently, and check boxes shouldn't sometimes behave like command buttons. Good programmers have been following these conventions since at least 1984, when Apple introduced the Macintosh.

There are sound reasons for observing user-interface norms. Millions of PC-savvy voters are familiar with them, and, in this case, the eSlate paged so quickly to the next screen that I wasn't certain my last choice was correctly recorded. Sure, I could push the left-arrow button to review the previous screen, but that shouldn't be necessary.

My final surprise came near the end of my voting experience. The voting machine had the state-mandated printer awkwardly bolted onto its side, and I could see a strip of paper scrolling by under glass, allowing me to review my votes. But it took a moment to realize I wasn't getting a copy. Of course, I knew the machine would keep a paper record in case a recount was necessary, but I thought I'd get a copy, too, like the receipt from an automatic teller machine. Nope. Although I don't think it's strictly necessary for machines to provide voters with a paper record, it did come as a surprise. (Note: Before publication, we sent a review draft of this editorial to Hart InterCivic and to the chief elections officer of the county where I voted, but neither the company nor the government official responded.)

Poor GUI Design Can Cost Votes

I'm not the only person confused by the GUIs of electronic voting machines. In Florida (where else?) there's a controversy over the results of a tight Congressional race on November 7. Of approximately 240,000 votes cast in the 13th District, the official winner has a 369-vote margin, but more than 18,000 electronic ballots cast in one county of that district (Sarasota) show no vote in that race. That's nearly a 15% undervote, compared with undervotes of 2.2% to 5.3% in neighboring counties in the same district.

Florida law requires a manual recount if the winning margin is less than 0.25%, so this race easily meets that test. Unfortunately, Sarasota County's touch-screen voting machines don't make paper records, so the manual recount is limited to absentee ballots, of which only about 3% show undervotes. Not that it matters, because the banana republic of Florida has ruled it unlawful to recount paper records of electronic ballots, anyway.

One hypothesis for the huge undervote in Sarasota County is "screen bounce": when voters touch the screen to make a choice, they can inadvertently cancel the choice if their finger brushes the screen again. But other counties using touch screens had much lower undervotes, so a more plausible hypothesis is GUI confusion: the Congressional race appeared on the same screen as the Florida gubernatorial contest. Some people voted for governor and then overlooked the Congressional candidates before advancing to the next screen.

That's exactly what happened to a good friend of mine who lives in Sarasota County. This person is no fool. She's a successful professional woman who runs her own property-management business, she has political experience, and she has voted in every election for more than 30 years. Yet, she admits to overlooking the 13th District Congressional candidates after voting for governor on that cluttered screen.

In my friend's case, she detected the omission while reviewing a summary screen before casting her votes. But instead of backing up and revising her ballot, she let her inadvertent undervote stand. She wasn't enthusiastic about either candidate—although she had intended to vote for one when she entered the booth.

Lessons Unlearned From the 2000 Election

Apparently, Florida election officials haven't learned much from the infamous "butterfly ballot" mistake in 2000. In that example of poor user-interface design, a punch-card ballot split the list of ten presidential candidates across two facing pages divided by a seam of irregularly aligned punch holes, then numbered the holes 3 through 13. Some voters had trouble figuring out which hole to punch and guessed wrong.

High-tech electronic voting machines were supposed to make that problem impossible, because their touch screens don't have split pages or seams. But by crowding the 13th District Congressional and Florida gubernatorial candidates onto the same screen, the programmers managed to create a virtual seam. Why must an electronic voting machine squeeze multiple races onto a single screen? Is Florida suffering from a shortage of pixels?

Remember that ambiguous undervotes were a plague of Florida's punch cards in 2000. Nobody can forget the heated debate over dimpled or hanging chads and whether they might telegraph the voter's intent. Electronic voting machines were touted as the modern solution to that problem. Now Florida has the same undervote problem, except without the punch cards to puzzle over.

At least this is one problem that's easily solved. Just add one more choice to every screen: "I choose not to vote in this contest." The screen wouldn't advance until the voter either casts a vote or explicitly chooses not to vote. It's a simple solution that requires only a few additional lines of source code and would completely eliminate ambiguous undervotes. That neither the Florida authorities nor the voting-machine designers have implemented such a simple solution reinforces my belief that states are rushing into electronic voting without enough forethought and with too little input from technical experts. (For travel expenses and a modest consulting fee, I offer to teach the programmers how to write that code.)

Fed-up Florida voters are finding their own solutions. In the same November 7 election, Sarasota County voters decided to adopt a voting system with verifiable paper ballots. The county will probably ditch the touch-screen contraptions in favor of an optical-scan system. And throughout the U.S., more voters are casting absentee ballots, even when they don't plan to be away from home on Election Day.

Consider These Alternatives

Electronic voting machines aren't really necessary. Optical-scan ballots look like the best alternative. They're inexpensive: a voting booth requires no machinery or electronics. They're easy: using the supplied felt-tip pen, simply draw a horizontal black line connecting an arrow next to the candidate's name. They're auditable: printed on heavy paper, the ballots are their own paper trail, and (unlike punch cards) they readily withstand multiple recounts by machine or by hand. They're fast: tabulation is automated. They're secure: if the tabulation machine's hardware or software is suspect, ballots can be recounted by another machine or manually, unlike electronic ballots.

One objection to paper ballots of any type is that counties must print numerous variations to include local contests and issues, down to the level of municipalities and school districts. The video screens of electronic voting machines can accommodate an infinite number of variations without the cost of printing, so the cost of the machine is amortized over time. However, the ballot screens still require careful layout and verification, just as paper ballots do. And cost shouldn't be the overriding concern for an infrequent public function as critical as voting.

Nevertheless, if we are forced by higher powers to use electronic voting machines, several precautions are in order. All machines should produce a verifiable paper trail. Sample electronic ballots with final screen layouts should be available to voters on the Internet before Election Day. At all times, voting machines should be kept as physically secure as marked paper ballots are. Voting-machine software should be community-developed open-source code, published on the Internet. All voting machines should run the same certified software. Making unauthorized modifications to the software in a voting machine should be a felony. All voting machines (except, perhaps, those for handicapped people) should share the same physical and graphical user interfaces.

The voting-machine manufacturers will probably complain that these rules don't give them enough room to differentiate their products, thus taking the profit out of electronic voting. Their complaints wouldn't bother me at all. Elections are the most mission-critical function of a democracy. They shouldn't be a profit center, nor should they be a test bed for someone's beta-level hardware and software.

For More Information For more information on both sides of this issue, visit the websites of Hart Intercivic (the company that makes the eSlate electronic voting machine) and Black Box Voting, a nonprofit organization that opposes electronic voting: www.hartintercivic.com www.blackboxvoting.org.