By: The National Committee on Voting Integrity (NCVI)
To the: U.S. Election Assistance Commission
“ Use, Security, and Reliability of Electronic Voting Systems”
May 5, 2004
We, the members of the National Committee for Voting Integrity (NCVI),
thank the U.S. Election Assistance Commission for holding a hearing
to review the "Use, Security, and Reliability of Electronic
Voting Systems." As new technology replaces the unreliable voting
system of the past, it is crucial that citizens feel justifiably
confident that their votes count and their voices are being heard.
However, we are very disappointed that those providing oral testimony
on the Technology Panel do not adequately reflect the widely held
views of computer
scientists and security experts. Only one of the four members of the panel, Dr.
Aviel Rubin, represents the opinion of most computer security experts that the
Direct Recording Electronic (DRE) machines used in the 2004 primary elections
are too insecure for deployment without a voter verified paper ballot (VVPB).
Over the last two years, security experts and election watchdogs
have uncovered a wide array of significant design defects in DRE
voting machines. These machines,
like other computers, are vulnerable to programmer error, equipment malfunction,
and malicious attacks. If this new technology is to become the foundation of
our democratic process, it must earn the trust of voters. There must be no uncertainty
about the quality and trustworthiness of these machines. All voting technology
put before the public must perform reliably from the start of the election to
the finish of the final vote tally, including any possible audits or recounts.
The unfortunate events in the Florida Presidential Election of 2000
have increased citizen awareness and scrutiny of our voting process.
Notably, citizens learned
how poor interfaces, such as the butterfly ballot, and poor vote-recording
methods, such as punchcards, could exclude their vote from the tally
or, possibly worse,
count their vote incorrectly. Events of the last year have shown that inadequately
designed, poorly tested, secret voting technology deployed by states and municipalities
have disenfranchised Americans throughout the country. Voters from California
to North Carolina have been turned away from polling booths or learned later
that their votes may not have been counted.
The March 2nd, 2004 primary election exposed several flaws in the current generation
of electronic voting machines, as is illustrated by the experience of Mr. Jeffrey
Liss of Montgomery County, Maryland. After voting on a paperless DRE, Mr. Liss
noticed a campaign sign for a candidate whose election had not been on his ballot.
Although poll workers initially did not believe there was a problem, Mr. Liss
finally convinced a poll worker to check the DRE ballot. Upon confirming that
the Senate race was indeed missing from the ballot, the poll worker provided
Mr. Liss with a provisional ballot for the Senate race. Frustratingly, Mr. Liss
later discovered that his provisional ballot was not included in the final tally.
This account raises several important questions. How many DRE ballots were not
included in the tally of the U.S. Senate race? How many other voters noticed
the absence of the Senate race, but did not succeed in obtaining a provisional
ballot? Of those voters who filled out a provisional ballot, how many were included
in the final count? The lack of a paper trail reduces any audit to pure guesswork
as to the scope and severity of this problem.
Incredibly enough, election vendors and some election administrators
attempted to declare the primary a success, despite the widespread
of voters in California and the subsequent discovery of uncertified software
DRE machines throughout the country. We must not allow the sanctity of our
elections to degenerate into a public relations campaign, based on the premise
newspapers, television and radio broadcasts can report new election technology
as a success, then all is well. Exit interviews with voters who tout the
ease-of-use of new touchscreen systems may convince other citizens to vote,
but they will
not convince the computers to operate correctly and securely. The strategy
of DRE vendors appears to be that of declaring success early and often without
for the reality of the situation. Triumphant press releases and articles
touting the usability of DRE touchscreen machines -- while brushing aside
as "glitches", "human error" or "a few isolated incidents" --
do not help secure our democracy.
How many times must we see these systems fail before we realize these incidents
are neither few nor isolated? Problems with DRE voting machines were apparent
as far back as the 2002-midterm elections, and again during the 2003 November
election. The Mississippi Senate was forced to void the results of races in Hinds
County due to a large number of under-votes, authorizing the county to conduct
another round of elections. A Florida special election that was decided by twelve
votes included 134 DRE ballots on which the voter made no selection, despite
the fact that it was the only election that day.
America should be the gold standard by which other nations measure the strength
and reliability of their electoral process. We must not and cannot tolerate a
situation such as that experienced by Mr. Liss and by millions of other voters
who find themselves voting on untrustworthy and insecure voting machines. The
idea that the votes of entire counties may be lost, misplaced, or manipulated
is unacceptable in our modern participatory democracy. Voters should feel secure
knowing that there is a permanent, tangible record of their ballot that will
serve as their voice in that election. Our democracy demands that we employ and
open process as we work steadily and openly to protect each and every vote.
HAVA assigns the full process of reviewing voting technology and the development
of standards to a Technical Guidelines Development Committee (TGDC), under the
leadership of the Director of the National Institute of Standards and Technology
(NIST). The TGDC consists of fourteen members appointed by the U.S. Election
Assistance Commission (EAC). The TGDC will provide rigorous testing and certification
procedures for laboratories that will certify new products. A Computer Science
Research Laboratory division will perform the majority of the work in detailing
the technical requirements and guidelines for approval by the TGDC, including
specifications for computerized voting terminals, cryptography, networks, remote
access voting, data storage, fraud detection and prevention methods, privacy
protection methods, and human factors in the design and use of voting systems.
Unfortunately, both NIST and the EAC face several hurdles. The 2004 fiscal year
budget passed by Congress decreases funds for the Research Labs by four percent,
and for the agency as a whole by fourteen percent. Lacking a full research lab,
the TGDC may have to rely more heavily on the expertise of its members during
the creation of electronic voting standards. Yet only four of the fourteen members
of the EAC are set-aside for technology experts; currently, these slots remain
The National Committee for Voting Integrity strongly encourages the U.S. Election
Assistance Committee to fill the four technical positions on the TGDC as soon
as possible. The EAC designates these seats for individuals who are readily identified
as leaders in key fields of study relating to secure, reliable computer systems,
including software correctness and verification, software engineering, security,
high reliability systems, and human-computer interaction. Technologists throughout
the United States have shown a great deal of interest in the subject of computerized
voting and how we as a nation apply information technology to our electoral process;
the resulting range of experts available to fill these positions on the TGDC
is very broad. However, the number of individuals who are known to have significant
research and development experience in the fields related to electronic voting
is much smaller. The NCVI has provided a list of those who posses the expertise
to serve on the Commission in this capacity.
While the EAC works to create the TGDC, we must also work to protect the integrity
of the upcoming election. During the 2004 Primaries, the short-term solution
for some polling locations was to supply provisional paper ballots to voters.
Precincts that did not have paper ballots asked voters to come back later. We
will never know how many voters were turned away from polling locations that
morning, denied their right to vote.
After the State of California investigated the malfunctions, widespread use of
uncertified software, and voter disenfranchisement that occurred during the Primaries,
the State banned the use of all DRE voting machines for the upcoming General
Election in November. Additionally, the Secretary of State directed election
officials to implement additional security procedures, including those outlined
in the SAIC and RABA studies conducted by the State of Maryland. We encourage
other states to limit the use of DREs, and study and adopt the recommended security
We would like to ask the U.S. Election Assistance Commission to
hold hearings specifically to address the concerns of computer scientists
and computer security
experts regarding the use and reliability of current DRE voting technology
that lacks a voter verified paper ballot.
It is important to note that HAVA does not require DREs. Optical-scan-based systems
are HAVA compliant, cost far less than DREs, and can be designed to allow voters
to independently verify their choices. Typically, a voter using an optical scan
system receives a paper ballot along with a marking pen or pencil. The process
is similar to filling out answers on a standardized test, a lottery ticket, or
a mail-in survey. Voters who are visually impaired or require ballots in a foreign
language can use tactile ballots or a computerized optical scan ballot-marking
machine with attached headphones. Such a machine would allow all voters, including
blind voters, to confirm or verify their ballot choices by sliding the ballot
into a computerized reader with attached headphones. In addition to repeating
the voter's choices through the earphones, the reader can alert the voter to
errors on the ballot, such as skipping a race or voting for too many candidates
in one race, and allow the voter to fix these errors in private.
Recent press reports indicate that the EAC feels that it is incapable of forestalling
widespread voting machine problems, but this is far from true. The EAC has the
power to immediately cease the release of HAVA funding for all voting systems
that are not independently auditable, and must be encouraged to do so. Furthermore,
all counties in the USA currently maintain absentee balloting systems; these
can be used to print ballots that are distributed at the polling places and then
scanned for totals. This creates a uniform voting methodology for each region
and provides a way to recount the ballots in order to check the accuracy of the
scanners. This can be used for the 2004 and future elections until such time
as the EAC is able to prepare an adequate security methodology to be applied
to electronic balloting systems. It is not too late to demand the use of the
paper-based systems that each county and state already has available for the
2004 election. Doing so will start the process of restoring confidence in the
voting process and will eliminate the expenditure of federal dollars on systems
that cannot possibly be HAVA compliant because the HAVA standards do not yet
exist. We should expect no less than strict control of the remaining HAVA funds
from the EAC leadership while security and auditability assurances are being
developed for the nation's voting equipment.
The history of the United States of America is the story of people fighting for
and defending the right to vote, the right to representation. Americans deserve
the most reliable, secure, and accurate voting system in every precinct and every
community. Voters deserve a tangible, privately verified record of their vote,
cast on machines that are accessible, easy-to-use, and free from subtle tampering
and foul play. We deserve openness in our voting process, including the right
to hire independent security and audit teams, free from non-disclosure agreements
and other secretive, restrictive licenses. Every citizen should have the right
to understand every step in our elections, from the time the voting machines
are built to when the final results are announced. And vendors who try to work
around election laws or hide known flaws undermine our democracy, and deserve
to face civil or criminal suits from the communities whose trust they betrayed.
The right to vote is the foundation of this country, carefully and clearly enumerated
in our Constitution. We owe it to our fellow citizens to work openly and steadily
to protect the rights of all voters. We encourage this commission to address
the defects present in current voting systems, and work to increase the accountability
and integrity of the American voting process.
The National Committee on Voter Integrity (NCVI) was established to promote voter-verified
balloting and to preserve privacy protections for elections in the United States.
The Committee brings together experts on voting issues from across the country.
Peter G. Neumann, Chair * David Burnham * David Chaum
* Cindy Cohn * Lillie Coney * David L. Dill * David Jefferson * Jackie Kane *
Douglas W. Jones * Stanley A. Klein * Vincent J. Lipsio * Rebecca T.
Mercuri * Justin
Moore * Jamin Raskin * Marc Rotenberg * Avi Rubin * Bruce Schneier *
Paul M. Schwartz * Barbara Simons * Sam Smith
FOR MORE INFORMATION, SEE
Return to the Home Page