Computer
Science
and
Technology
--------------------------------------------
NBS Special
Publication 500-158
Accuracy,
Integrity, and Security in
Computerized
Vote-Tallying
Roy G.
Saltman
Institute for Computer Sciences and Technology
National Bureau of Standards
Gaithersburg, MD 20899
Sponsored by:
John and Mary R. Markle Foundation
75 Rockefeller Plaza, Suite 1800
New York, NY 10019-6908
August 1988
U.S. DEPARTMENT OF COMMERCE
C. William Verity, Secretary
National Bureau of Standards
Ernest Ambler, Director
ACCURACY, INTEGRITY, AND SECURITY
IN
COMPUTERIZED VOTE-TALLYING
Roy G. Saltman
Recommendations are provided to promote accuracy, integrity, and security in computerized vote-tallying, and to improve confidence in the results produced. The recommendations respond to identified problems, and concern software, hardware, operational procedures, and institutional changes.
It is proposed that the concept of internal control, almost universally used to protect operations that produce priced goods or services, be adapted to vote-tallying, a non-priced service. For software, recommendations concern certification, assurance of logical correctness, and protection against contamination by hidden code. For hardware, recommendations concern accuracy of ballot reading, and design and certification of vote-tallying systems that do not use ballots. Improved pre-election testing and partial manual recounting of ballots are recommended operational procedures.
Some recent significant events concerning computerized vote-tallying are reported. These events include development of performance specifications, publication of a series of New York Times articles, and activities in Texas leading to passage of a revised statute on electronic voting systems. Relative vulnerabilities of different types of vote-tallying systems, i.e., punch card, mark-sense, and direct recording electronic, are discussed. Certain recent elections in which difficulties occurred are reviewed, and categories of failures are highlighted.
Key words: accuracy; computer; election; integrity; internal control; public administration; security; vote-tallying.
ACKNOWLEDGMENTS
The author wishes to acknowledge assistance received from those individuals who provided documentation of election difficulties, reviewed drafts of this report, or otherwise gave of their time and ideas. These persons include Penelope Bonsall, Director, FEC Clearinghouse; Robert Boram, Director of Engineering, R.F.Shoup corp.; Kimball Brace, President, Election Data Services, Inc.; David Burnham, journalist, Washington, DC; David Clampitt, Oklahoma City, Oklahoma; Terry Elkins, Dallas, Texas; Curtis Fielder, DFM Associates; Emmett Fremaux, Jr., Executive Director, DC Board of Elections and Ethics; Marie Garber, formerly Administrator, Maryland State Administrative Board of Election Laws; Paul Goldy, President, and Jacob Merriwether, Vice President, International Technology Group; Russ Harlan, Assistant Registrar of Voters, Placer County, California; Michael Harty, formerly Director of Voting Systems and Standards, Illinois State Board of Elections; Ralph Heikkila, Assistant Registrar-Recorder, Los Angeles County; Lance Hoffman, professor of computer science, George Washington University; Michael Lavelle, formerly Chairman, Chicago Board of Election Commissioners; Robert Lemens, formerly Assistant Attorney General, State of Texas; David Link, Dean, Notre Dame Law School; Conny McCormack, formerly Director of Elections, Dallas County, Texas; John Medcalf, President, VOTEC; Robert Naegele, President, Granite Creek Technology; Tod Rapp, President, Triad GSI; Jim Riggs, formerly Director of Elections, Maricopa County, Arizona; Deborah Seiler, Chief, Elections and Political Reform Division, State of California; Larry Slesinger, formerly Program Officer, John and Mary R. Markle Foundation; Richard Smolka, editor, Election Administration Reports; David Stutsman, attorney, Elkhart, Indiana; Robert Tyre, Executive Vice President, Business Records Corporation; Malin VanAntwerp, Project Director, ECRI, Plymouth Meeting, PA; Thomas Van de Bussche, Director of Data Processing, Carroll County, Maryland; Douglas Webb, Senior Consultant, SRI International; Britain Williams, Chief, Computer Technology and Applications Division, Georgia Tech Research Institute; Jackie Winchester, Supervisor of Elections, Palm Beach County, Florida.
Regardless of assistance received, the author accepts full responsibility for the content of this report.
Roy G. Saltman
TABLE OF CONTENTS
1. SUMMARY OF CONCLUSIONS AND
RECOMMENDATIONS
1.1
Problems Of Computerized Vote-Tallying
1.2
Government Responsibilities
1.3
Implementation Of An Internal Control Function
1.4
FEC Clearinghouse Specifications
1.5
Revised Texas Statute On Electronic Voting Systems
1.6
Recommendations On Software
1.6.1
Certification
1.6.2
Integrity and Logical Correctness
1.6.3
Dedicated Software Use and Dedicated Operation
1.7
Recommendations On Hardware
1.7.1 Accuracy of Ballot Reading
1.7.2
Elimination of Pre-Scored Punch Card Ballots
1.7.3
Counting of Rejected Ballots
1.7.4
Required Research
1.7.5
Design of Direct Recording Electronic (DRE) Machines
1.7.6
Certification of DRE Data Entry Logic
1.8
Recommendations On Operational Procedures
1.8.1
Pre-Election Checkout
1.8.2
Audit Trails
1.8.3
Complete Data From Split Precincts
1.8.4
Access Controls
1.8.5
Application Internal Controls for Ballot-Tallying Systems
1.8.6
Application Internal Controls for DRE Systems
1.9
Relative Vulnerabilities Of Different System Types
1.10
Review Of Recent Difficulties In Computerized Vote-Tallying
1.11
Future Vote-Tallying Systems
2. BACKGROUND, AND RECENT SIGNIFICANT
EVENTS
2.1
Accuracy, Integrity, And Security
2.2
ICST's 1974/1975 Project On Computerized Voting
2.3
Some Pertinent Technological Changes Since 1975
2.4
Development Of Standards For Voting Equipment
2.5
Establishment Of The Election Center
2.6
New York Times Articles On Computerized Voting
2.7
California Attorney General's Report
2.8
Texas Controversy, Hearings, And Legislation: 1986/1987
2.8.1
Controversy Over 1985 Dallas Mayoralty Contest
2.8.2
Texas Secretary of State's Directive
2.8.3
Legislative Hearings
2.8.4
Revised Texas Statute on Electronic Voting Systems
2.9
Current Problems Of Computerized Vote-Tallying
2.9.1
Difficulty in Verifying Results
2.9.2
Possibility of Undiscoverable Frauds
2.9.3
Election Administrators' Lack of Knowledge and Resources
3. TYPES OF VOTE-TALLYING SYSTEMS, THEIR
VULNERABILITIES,
AND THEIR NATIONAL DISTRIBUTION
3.1
Vote-Tallying As Part Of Voting
3.2
Paper Ballots
3.2.1
Vulnerabilities of Paper Ballots
3.3
Lever Machines
3.3.1
Summarizing Lever Machine Results
3.3.2
Vulnerabilities of Lever Machines
3.4
Punch Card Voting
3.4.1
Vulnerabilities of Punch Card Use
3.4.2
Types of Punch Cards
3.4.3
Voting With the "Votomatic" Card
3.4.4
Vulnerabilities of the "Votomatic" System
3.4.5
Voting With the "Datavote" Card
3.4.6
Vulnerabilities of the "Datavote" System
3.5
Voting With A Mark-Sense Ballot
3.5.1
Vulnerabilities of Mark-Sense Ballot Systems
3.6
Precinct Versus Central Count For Machine-Readable Ballots
3.6.1
Vulnerabilities of Precinct Count and Central Count
3.7
Direct Recording Electronic (DRE) Machines
3.7.1
Summarization of DRE Machine Results
3.7.2
Vulnerabilities of DRE Machines
3.8
Software For Computerized Vote-Tallying
3.8.1
Vulnerabilities of Software
3.8.2
Integration of Administrative Software
3.9 Local Conduct Of
Elections And Distribution Of System Types
3.9.1
The Number of Major Election Jurisdictions
3.9.2
Distribution of System Types
3.10 Future
Vote-Tallying Systems
3.10.1
Technological Possibilities
3.10.2
Political and Social Priorities
4. SOME RECENT DIFFICULTIES IN COMPUTERIZED
VOTE-TALLYING
4.1
Carroll County, Maryland: November, 1984
4.2
Charleston, West Virginia: November, 1980
4.3
Dallas, Texas: April, 1985
4.4
Elkhart County, Indiana: November, 1982, And November, 1986
4.4.1
November, 1982 General Election
4.4.2
November, 1986 General Election
4.5
Gwinnett County, Georgia: November, 1986
4.6
Illinois - Statewide Testing Program
4.6.1
Programming and/or Program Initialization Errors
4.6.2
Hardware and Punch Card Difficulties
4.7
Maricopa County, Arizona: September, 1986
4.8
Moline, Illinois: 1985 Consolidated Municipal And Township Election
4.9
Oklahoma County, Oklahoma: November, 1986
4.10
Palm Beach County, Florida: November, 1984
4.11
Salt Lake County, Utah: November, 1980
4.12
Stark County, Ohio: May, 1986
4.13
Summary Of Problem Types
4.13.1
Insufficient Pre-election Testing
4.13.2
Failure to Implement an Adequate Audit Trail
4.13.3
Failure to Provide for a Partial Manual Recount
4.13.4
Inadequate Ballots or Ballot-Reader Operation
4.13.5
Inadequate Security and Management Control
4.13.6
Inadequate Contingency Planning
4.13.7
Inadequate System Acceptance Procedures
5. APPLYING INTERNAL CONTROL TO
COMPUTERIZED ELECTIONS
5.1
Internal Control And Computer Security
5.2
Internal Control As Control Of Assets
5.3
Voting And Banking Operations: Accounting Similarities
5.4
The GAO Concept Of Internal Control
5.4.1
Purposes of Internal Control
5.4.2
GAO Definition of Internal Control
5.4.3
GAO General Standards
5.4.4
The Concept of a Non-Financial Transaction
5.4.5
GAO Specific Standards
5.5
A Classification Of Internal Controls
5.5.1
General Controls
5.5.2
Application Controls
5.6
The Discipline Of Internal Control
5.6.1
Link to a Professional Body of Knowledge
5.6.2
Job Functions for Internal Control
6. DETAILED CONCLUSIONS AND
RECOMMENDATIONS
6.1 The Continuing
Problem Of Confidence In Results
6.2
Responsibility And Requirements For The Effective Management Of Elections
6.2.1
Government Responsibility
6.2.2
Expertise and Effective Management
6.2.3
Requirements
6.2.4
FEC Clearinghouse Performance Specifications
6.3
Implementation Of An Internal Control Function
6.3.1
Outside Recommendations vs. In-house Expertise
6.3.2
Achievement of Management Goals
6.3.3
Analysis of Risks and Impact on Public Confidence
6.4
Review Of The Adequacy Of State Laws And Regulations
6.4.1
Revised Texas Statute on Electronic Voting Systems
6.4.2
Effective Use of Technical Terminology
6.5 Future
Vote-Tallying Systems
6.6 Transfer Of
Technical Knowledge To Election Officials
6.7 Adoption Of FEC
Clearinghouse Concepts For Product Acceptance
6.8 Software
Certification, Performance, And Integrity
6.8.1
Certification of Software
6.8.2
Requirements for Certification
6.8.3
Integrity of Software
6.8.4
Dedicated Operation and Use
6.8.5
Logical Correctness of Vote-Tallying Software
6.8.6
Design for Specialization and Prevention of Logic Changes
6.8.7
Deposit and Availability of Certified Software
6.9
Accuracy Of Ballot Reading
6.9.1
Accuracy Goal
6.9.2
Elimination of Pre-scored Punch Card Ballots
6.9.3
Treatment of Rejected Ballots
6.9.4
Required Research
6.10
Design of DRE Machines
6.10.1
Recording of Each Undervote
6.10.2
Retention of Voter-Choice Sets
6.10.3
Accuracy of DRE Machines
6.11
Certification Of DRE Hardware Logic
6.12
Selection Of A Vote-Tallying System
6.13
Pre-Election Checkout
6.14
Implementation Of Audit Trails
6.14.1
Full Ballots-Cast Data from Split Precincts
6.15
Access Controls
6.15.1
Site Controls
6.15.2
Equipment Access Controls
6.15.3
Transportation and Handling Controls
6.15.4
Voting Process Controls
6.15.5
Telecommunications Security Controls
6.16
Application Internal Controls For Ballot-Tallying Systems
6.16.1
Controls over Blank Ballots Printed and Distributed
6.16.2
Numbering of Ballot Stubs
6.16.3
Controls over Ballot Use
6.16.4
Control of Ballot Validity
6.16.5
Machine-readability of Ballot's Precinct Number
6.16.6
Accuracy of Telecommunication of Voting Data
6.16.7
Control for Vote Summarization
6.16.8
Vote Reconciliation by Contest
6.16.9
Recording of Undervotes and Overvotes
6.16.10
Recounting
6.17
Application Internal Controls For DRE Systems
6.17.1
Voter Count Match
6.17.2
Accuracy of Telecommunication of Voting Data
6.17.3
Vote Reconciliations
6.17.4
Recounting of Voter-Choice Sets
6.17.5
Post-Election Checkout
6.18
The Recommendations In Relation To The Identified Problems
REFERENCES
1. SUMMARY OF CONCLUSIONS AND RECOMMENDATIONS
This report has been prepared with funding provided by the John and Mary R. Markle Foundation of New York City. The Markle Foundation requested that the National Bureau of Standards (NBS) undertake this study because of concern about the potential for inaccuracy or fraud in computerized vote-tallying. NBS was approached because of its experience with the subject matter as a result of a previous project undertaken by the author for the U.S. General Accounting Office.
Concern had been heightened by a series of articles published in the summer of 1985 in the New York Times. The articles cited statements by two computer experts reporting that a computer program widely used for vote-tallying was vulnerable to tampering. Several elections were identified in which losing candidates claimed that it would be possible to fraudulently alter the computer programs that were used in their contests.
1.1 Problems Of Computerized Vote-Tallying
In preparation for this report, a review of recent public statements and documents was undertaken that indicated concern about computerized vote-tallying. The review showed that the problems could be categorized as follows: there is difficulty in verifying results; there is the possibility of undiscoverable frauds; and election administrators lack some necessary knowledge and resources.
While proof of actual computer program manipulation appears to be lacking, documentation conclusively demonstrating otherwise is generally insufficient, due to the manner in which many computerized elections are conducted. It has been clearly shown that audit trails that document election results, as well as general practices to assure accuracy, integrity, and security, can be considerably improved.
1.2 Government Responsibilities
The recommendations that respond to these problems are directed to State and local government election officials. Elections for State and Federal offices are conducted by local government (generally county, township, and city) administrators. In about one-third of all counties, voting is carried out using computerized equipment. Jurisdictions using computerized equipment include over one-half of all registered voters.
Local administrators require the necessary resources and expertise to efficiently and effectively carry out their responsibilities. These responsibilities generally include procurement of vote-tallying systems and supporting services. An effective procurement must include specifications that assure accuracy, integrity, and security. The local administrators also have the responsibility for implementing the necessary management control systems to enable the public to have confidence in the results produced.
Election officials require a source of neutral expertise for the receipt of new technical and administrative information. The establishment of the Election Center in the Academy for State and Local Government clearly fulfills a need. Its efforts should be expanded.
1.3 Implementation Of An Internal Control Function
Internal control is a set of systematic procedures used to guard against errors, waste, and fraud. It is nearly universally used as a management technique to safeguard assets, and to protect operations that result in goods or services priced for sale. Voting services are not priced, and the discipline of internal control has not been systematically applied. Applicability of the discipline to vote-tallying requires only the re-definition of the concept of a transaction. A transaction is now defined as a business event that is measured in money and that is entered into accounting records; a re-definition would allow a transaction to include a step in the implementation of an entitlement that is not measured in money.
Essential recommendations are that the concept of internal control should be re-defined as indicated, and that persons knowledgeable in that professional field should be utilized to assist in the establishment and implementation of sound operational procedures. To the extent that procured computerized voting equipment and software must have capabilities that support internal control, applicable requirements should be included in procurement specifications.
Expertise in internal control (which includes computer security) should be added to the personnel complement in election administration in order to assure implementation of applicable concepts. In addition, an internal auditor should be available to independently review the implementation of internal controls and report on their effectiveness. Internal control is a professional activity; trained persons, texts, and a community of practitioners are available. Internal control expertise may be shared among government agencies or provided at the State level if individual agency resources are insufficient.
An important function of internal control is to identify system vulnerabilities and convert them into a set of realistic threats. Responses must be devised that are consistent with available or obtainable resources, based on a risk analysis determining the likelihood and cost of actual exploitation of a particular vulnerability. As a result, internal controls personnel should be able to provide assurances to the public that the potential threats are understood, have been prioritized for significance, and are being countered.
The availability of internal control specialists should relieve election administrators from having to be personally knowledgeable about specific technical matters best left to individuals who are professionally qualified in that field. With the addition of needed technical resources to the staff, election administrators would be able to retain management control. Administrators would not have to abdicate control to others, such as vendors or data processing center directors. Thus, election administrators would be able to retain the capability of managing the process of assuring accuracy, integrity, and security in vote-tallying.
1.4 FEC Clearinghouse Specifications
The performance specifications being developed by the National Clearinghouse on Election Administration of the Federal Election Commission (FEC Clearinghouse) are approaching completion. They are intended for Statewide adoption. Each State should consider the adoption of these specifications when they are issued.
Acceptance procedures for hardware and software should be consistent with the FEC Clearinghouse implementation plan for adoption of these specifications. That plan calls for qualification and certification prior to final acceptance. Qualification implies conformance with standards and functional requirements, and may be done once to satisfy many States. Certification ensures that the product meets State requirements. Acceptance testing evaluates the degree to which the specific units delivered to the local government conform to approved characteristics.
1.5 Revised Texas Statute On Electronic Voting Systems
The requirements of the revised Texas statute on electronic voting systems should be considered for adoption in those States that have not already adopted equivalent or more stringent provisions. Requirements of the Texas statute include audit trails, deposit of computer programs with the secretary of state, assurance that programs used in vote-tallying are identical to those deposited, mandatory one percent manual recount of all contests, testing of equipment using all applicable ballot formats, disconnect of remote terminals during vote tabulations, and specific scrutiny of ballot count discrepancies.
1.6 Recommendations On Software
1.6.1 Certification
Products to be certified should include all vote-tallying software and all software to be mounted together with vote-tallying software. Certification implies State approval. Only certified software should be permitted to be used within the State. After software has been certified, no design changes should be permitted without a re-certification. All software that has been certified should be deposited with the chief election official of the State. Consistent with the revised Texas statute, the materials on file should not be public information, but should be available to law enforcement authorities, on proper application, for investigation of election irregularities.
Specialization of vote-tallying software for a particular election should occur only with a "fill-in-the-blanks" procedure, not with logic design changes. Header cards used in vote-tallying operations should not change the logic of a program.
1.6.2 Integrity and Logical Correctness
As a requirement for certification, all vote-tallying software, and all software used with it, should be reviewed for integrity, that is, for the ability to carry out its asserted function and to contain no hidden code. Vote-tallying software should be tested, in addition, for logical correctness. Vote-tallying software includes software for election specialization and ballot generation, as well as vote-summarizing software. Satisfaction of the requirements may be done as part of qualification.
As part of the effort to maintain integrity of software, accountability of the source is essential. Copying of software from unaccountable sources must be forbidden. To minimize requirements for testing, all software should be obtained from a stock of products offered publicly by reputable vendors. Software that cannot be obtained in this manner must be thoroughly checked.
1.6.3 Dedicated Software Use and Dedicated Operation
An important procedure to assure system integrity is to isolate vote-tallying and support software from influences over which the election administration has no control.
After all software to be used together has been certified, it should be maintained separately under the control of the election administration and not used together with uncertified software. It is strongly recommended that certified vote-tallying software not be allowed to run on a multiprogrammed general-purpose computer on which uncertified support software or applications also are being run.
1.7 Recommendations On Hardware
1.7.1 Accuracy Of Ballot Reading
The value of a ballot-tallying system is that it should be possible, with a recount, to duplicate the result of an election. The problems found in ballot-reader inaccuracy, both in the count of ballots, and in the count of votes on ballots, are a significant source of lack of confidence in vote-tallying.
A recommended goal is that a computerized vote count should be able to be reproduced on a recount with no more than a change in one vote for each ballot position in ballot quantities of up to 100,000 when machine-generated (ideal) ballots are used. A ballot reader should be able to tolerate a wide range of punching or marking behavior by a voter without a significant increase in error.
1.7.2 Elimination of Pre-Scored Punch Card Ballots
The use of pre-scored punch cards contributes to the inaccuracy and to the lack of confidence. It is generally not possible to exactly duplicate a count obtained on pre-scored punch cards, given the inherent physical characteristics of these ballots and the variability in the ballot-punching performance of real voters.
It is recommended that the use of pre-scored punch card ballots be ended. One method now available to eliminate pre-scored cards, while retaining the "votomatic" concept, is with a new type of hole-punching stylus that uses spring-loading. A hole of consistent and acceptable dimensions can be created by a voter using the new stylus without the need for pre-scoring. The internal construction of the "votomatic" ballot holder must be altered with the use of the new stylus. Other devices and methods for elimination of pre-scored punch card ballots also may be effective.
1.7.3 Counting of Rejected Ballots
If a ballot cannot be read by machine, administrative controls should be in place to permit such ballots to be counted manually. A voter's choices should not be lost because of machine failure.
1.7.4 Required Research
Testing to determine the accuracy of current ballot reading systems (such as that now being carried out by ECRI of Plymouth Meeting, PA), and research to improve ballot tallying systems in accuracy and ease of voter use, are important to pursue.
1.7.5 Design of Direct Recording Electronic (DRE) Machines
With DRE machines, no ballot is used. The voter enters choices directly into a storage unit of the machine with the use of pushbuttons, a touch-screen, or similar devices. As no voter-generated records of choices exist, and no recount independent of the machine is possible, steps should be taken in the design of these machines to assure complete confidence in the reported results.
A problem with most DRE machines as currently designed (as with lever machines, their predecessors), is that there is no difference in the results seen between a voter's failure to cast a vote and the machine's failure to record a vote.
Recording of Undervotes: It is recommended that each DRE machine be designed so as to take a positive action indicating a "no vote" for every choice that the voter fails to take. When voting is complete, the voter's choices, and any "no votes" for votes not taken, would be transferred to a more permanent storage for summation with other voters' choices. The required transfer and summation of the "no votes" would serve as positive indications of the voter's failure to make certain specific choices. Thus, there would be no ambiguity about whether the voter failed to vote or the machine failed to record selections.
Retention of Voter-Choice Sets for Summation Verification: Each voter-choice set (i.e., the machine's record of all choices of a voter) should be retained in the machine on a removable non-volatile medium (e.g., magnetic disk). Storage locations of the voter-choice sets would have to be randomized to prevent association of a particular set with a particular voter. The retention of the voter-choice sets makes possible a verification (on an independent machine) of the DRE machine's summation of the voters' choices that it recorded. The correctness of the machine's data entry process cannot be checked in this manner.
1.7.6 Certification of DRE Data Entry Logic
DRE data entry hardware should be certified for logical correctness, by examination of the logic design and by testing under a large variety of different conditions. The DRE data entry function must be correct, as there are no ballots to provide an independent check. The data entry logic and its documentation should be deposited with the State, as described above in 1.6.1.
1.8 Recommendations On Operational Procedures
1.8.1 Pre-Election Checkout
Lack of sufficient pre-election testing appears to be a major source of operational difficulty. Sufficient pre-election testing should be done so that errors in software specialization or in implementation of logical rules, if any, will become obvious. It is recommended that to the greatest extent possible, all hardware and software to be utilized should be given a dry run simulating specific conditions to be faced on election day and election night.
1.8.2 Audit Trails
Audit trails provide the supporting documentation through which the correctness of the reported results may be verified. Two types of audit trails are necessary to document operations and provide confidence in the results reported. One type records steps in the operation of the equipment, while the other records steps in the voting and vote-tallying processes.
1.8.3 Complete Data From Split Precincts
Each split of a split precinct should be treated like a separate precinct for the reporting of ballots and votes cast. However, voter privacy must be a concern for splits containing a very small number of voters.
1.8.4 Access Controls
Access (i.e., security) controls must be in place during preparations for voting, voting itself, and vote-tallying. These controls concern access to sites, areas, facilities, equipment, documents, files, and data. The controls cover transportation of ballots and telecommunication of results.
1.8.5 Application Internal Controls for Ballot-Tallying Systems
These controls should be in place to prevent all types of ballot frauds and miscounting errors, and to provide the documentation and assurance that the correct results are reported. Controls on ballots cover printing and distribution, accounting for use, validity, and prevention of errors due to mishandling. Controls on data and calculations provide for accurate telecommunication of data, recording of undervotes and overvotes, vote reconciliations that demonstrate consistency, and assurance of accurate vote summarization. A manual recount of at least one percent of the ballots of each contest is recommended. Responsibility for selection of some of the precincts to be recounted should be granted to candidates or parties.
1.8.6 Application Internal Controls for DRE Systems
These controls should be in place to provide documentation and assurance that the correct results are reported when DRE systems are used. The controls cover matching machine use with voter totals, vote reconciliations on each machine, recounting of voter-choice sets, and post-election checkout of machines.
1.9 Relative Vulnerabilities Of Different System Types
Each type of system has its own particular vulnerabilities. A comparison of system types shows that each has its advantages and disadvantages. It is possible to effectively utilize any of the computerized systems discussed (punch card, mark-sense, or DRE) provided that, among other requirements, procurement specifications are well-written in accordance with needed performance, and factors of accuracy, reliability, and recommended design concepts are included in the specifications.
1.10 Review Of Recent Difficulties In Computerized
Vote-Tallying
Ten computerized voting situations in which difficulties occurred are reviewed in detail in this report. The four situations identified in the New York Times article of July 29, 1985 are among those reviewed. Problems in several other situations are briefly described.
Although none of the situations has provided solid evidence of computer program manipulation, the reviews have revealed the need for improvements in hardware and software performance and in operational procedures, and they have provided support for the need for institutional changes. Thus, the reviews have influenced the recommendations provided in this report.
Specific recommendations directly resulting from the reviews of difficulties include the recommendations on improved accuracy in ballot tabulation, elimination of pre-scored punch card ballots, assurance of the counting of ballots rejected by readers, provision of complete data from split precincts, and more thoroughness in pre-election checkout.
1.11 Future Vote-Tallying Systems
While vote-tallying using telephones or stations similar to automatic teller machines is technologically feasible, the decision to implement such a system must be based on more fundamental factors. Any installed system must meet political and economic requirements, as well as technical requirements of accuracy and reliability. Political needs include equal access by individuals, the ability to verify registration, and the ability of the voters to vote in secret without intimidation. Internal controls must be implementable to demonstrate the correctness of the reported results. Benefits, such as increased voter convenience and possible improved participation rates, must be compared against the costs of implementation.
2. BACKGROUND, AND RECENT SIGNIFICANT EVENTS
This report has been prepared in partial fulfillment of the conditions of funding received in November, 1986, by the Institute for Computer Sciences and Technology (ICST) of NBS from the John and Mary R. Markle Foundation of New York City. The Markle Foundation is privately endowed, and has a programmatic interest in the role of computer technology and communications in public affairs.
As a nonregulatory agency of the U.S. Department of Commerce, NBS was established in 1901 specifically to aid manufacturing, commerce, government, and academia through application of its expertise in science and technology. In connection with its consulting role, NBS may accept outside funding that is consistent with its mission and programs.
ICST carries out the responsibilities mandated to the Department of Commerce under the Brooks Act (P.L. 89-306). ICST develops techniques and tools to help organizations make more effective use of computers and information technology. In addition, ICST serves government and industry by developing Federal Information Processing Standards (FIPS), technical reports, and test methods, and by providing technical assistance to advance new uses of computer technology. In 1987, additional responsibilities were assigned to ICST due to the passage of the Computer Security Act (P.L. 100-235). In accordance with this act, ICST will develop standards and guidelines on computer security to protect the U.S. Government's sensitive but unclassified information.
2.1 Accuracy, Integrity, And Security
This report concerns measures to assure the presence of accuracy, integrity, and security in computerized vote-tallying. Accuracy is the essential requirement of a computerized vote-tallying system, but its achievement may not be possible without the implementation of integrity and security. Even if accuracy is attained, confidence in the results may not be assured unless the other two factors can be shown to be present. Thus, for vote-tallying systems, these factors are not mutually exclusive parameters that can be separately considered.
Definitions, for the purpose of this report, are as follows:
accuracy: conformity of the output data of a vote-tallying system with logically correct and acceptably precise treatment of all input data provided to the system;
integrity: the state of a vote-tallying system in which it will correctly perform the functions specified for it, and only those functions;
security: the achievement of a desired control of access to vote-tallying facilities, areas, equipment, supplies, documents, media, files, and data.
2.2 ICST's 1974/1975 Project On Computerized Voting
The origins of the current project go back to 1974. In February of that year, ICST was asked by the General Accounting Office (GAO) to "conduct a systems analysis and evaluation of the role of automatic digital processing equipment in the vote-tallying process." The year-long project, undertaken also by the author of this latest report, was completed in 1975.
The project had been requested by the GAO through one of its components, the National Clearinghouse on Election Administration of the Office of Federal Elections, in recognition of concerns expressed in Congress, and by election officials and the public, about the use of computing technology in vote-tallying. These concerns had been aroused by the issue of the potential for the fraudulent alteration of vote-tallying computer programs, and by actual difficulties experienced in computer-based elections. The possibility of fraudulent manipulation of computer programs had been raised by computer experts in Los Angeles in 1969. Serious problems in computerized vote-tallying had been experienced in San Francisco in 1968, in Los Angeles and Detroit in 1970, in Los Angeles and Houston in 1972, and in other places in the years immediately prior to the request for the report.
The product of the 1974/1975 project was a report entitled Effective Use of Computing Technology in Vote-Tallying [1]. The report identified the hardware, software, and administrative problems that had been encountered at that time, and specified operational guidelines that election administrators could implement to help assure the accuracy and security of the vote-tallying process. Several thousand copies of the report were distributed to election administrators throughout the nation by the National Clearinghouse on Election Administration. That organization, in 1975, had become a part of the newly established Federal Election Commission; it is identified elsewhere in this report as the FEC Clearinghouse.
2.3 Some Pertinent Technological Changes Since 1975
Since the 1975 report, there have been many additional experiences in the application of computerized vote-tallying, and considerable improvements in computer technology. In computer hardware, the most important changes have been improved speeds of operation, smaller physical size, and availability of larger quantities of random access and disk memory. The improved speeds and memory quantities are obtainable at considerable reductions in cost. The lower costs and improvements in technology have made possible the proliferation of smaller computers with considerable capability. Thus, it is now possible for many smaller election administrations to consider the acquisition of their own computing power, in order to achieve efficiencies and provide more direct management control over their operations.
There has been, also, continued improvements in tools and techniques for the management of technology. Tools include the availability of new standards in computer technology such as for media, programming languages, communications protocols, and data protection. Techniques include the concepts of software engineering, computer security, internal control, and EDP (electronic data processing) auditing.
The changes in computer technology, and the availability of new tools and techniques, have been considered in the development of the recommendations of this report.
2.4 Development Of Standards For Voting Equipment
In January, 1980, partly as a result of the 1975 ICST report, Congress adopted P.L. 96-187, Section 302, which stated that:
"The Federal Election Commission, with the cooperation and assistance of the National Bureau of Standards, shall conduct a preliminary study with respect to the future development of voluntary engineering and procedural performance standards for voting systems used in the United States. The Commission shall report to the Congress the results of the study, and such report shall include recommendations, if any, for the implementation of a program of such standards (including estimates of the costs and time requirements of implementing such a program). The cost of the study shall be paid out of any funds otherwise available to defray the expenses of the Commission."
In 1983, the preliminary study was completed with the recommendation that "performance standards for voting systems are both needed and feasible." In 1984, the FEC Clearinghouse began to develop such standards. As of the summer of 1988, the hardware, software, and test standards for punch card, mark-sense, and DRE voting systems are approaching completion [2]. An executive summary of these standards also is being prepared [3]. The FEC Clearinghouse has also prepared a draft implementation plan for the voting system standards [4], and a "System Escrow Plan" [5]. The latter concerns the problem of controlling access to proprietary source code while States and local governments (or their agents) are provided with the ability to test the vote-tallying software for integrity.
Implementation of the standards would address some of the identified problems of computerized vote-tallying summarized below in section 2.9.
2.5 Establishment Of The Election Center
The Election Center, affiliated with the Academy for State and Local Government, was established in 1984. The Center is an independent non-profit resource center serving registration and election officials. National and regional election conferences sponsored by the Center, as well as reports and other data distributed to officials, provide training and information in some thirty-five areas of election administration.
The Center has recently distributed the report of a workshop [107] held on Captiva Island, Florida, in February, 1987. The workshop concerned computerized vote-tallying and included, as participants, election officials, vendors, computer scientists, and others interested in the election process. The workshop was funded by grants to the George Washington University by the John and Mary R. Markle Foundation. The Election Center had no part in the workshop but, because of its clientele, served as a convenient avenue of distribution for the report.
The Academy for State and Local Government is a non-profit research organization that fosters understanding of American government at all levels. The Academy is governed by a board of trustees composed of the executive directors of seven organizations representing States, counties, cities, and the chief officials of these jurisdictions.
2.6 New York Times Articles On Computerized Voting
A series of articles on computerized voting was published in the New York Times in 1985, commencing on July 29 of that year. In the first article, published on page one and entitled "Computerized Systems for Voting Seen as Vulnerable to Tampering" [6], it was charged that:
"The computer program that was used to count more than one-third of the votes cast in the Presidential election last year is very vulnerable to manipulation and fraud, according to expert witnesses in court actions challenging local and Congressional elections in three states...
"The vote counting program that has been challenged in Indiana, West Virginia and Maryland was developed by Computer Election Systems of Berkeley, Calif. In Indiana and West Virginia, the company has been accused of helping to rig elections. The computer program has also been challenged in Florida, but so far experts have not been permitted to examine the program in connection with the challenge.
"John H. Kemp, president of Computer Election Systems, said in a telephone interview that he absolutely denied that the company was involved in fraudulent schemes. County officials involved in the cases also have categorically denied participation in fraud."
The article went on to state that allegations that the computer program provided by Computer Election Systems was "open to manipulation and fraud were supported by two ... experienced computer consultants who independently examined material obtained in the pending court cases for the New York Times." The two experts cited were Howard Jay Strauss, associate director of the Princeton University Computer Center, and Eric K. Clemons, an associate professor of decision sciences at the Wharton School of the University of Pennsylvania.
Mr. Strauss was reported as saying that "the program used to count Indiana votes was vulnerable to manipulation." He was additionally quoted as follows:
" 'Extra votes may be entered in the form of bogus ballots on punch cards, or vote totals may be altered through the use of control cards,' Mr. Strauss said. 'Either of these assaults on the system could be performed successfully by a computer novice.'
"Mr. Strauss added that someone with 'a fair amount of computer knowledge' could turn off the portion of the program designed to document any changes made in either the program or the votes being counted by the program."
However, an examination of the complete text submitted by Mr. Strauss to the New York Times shows that he also stated that:
"If a better audit trail was part of the program, and if better procedures were followed in running the program, then all of the assaults on the system described above [for entering extra votes or altering votes] could easily be detected...
In addition, in response to the question, "Can the program be made safer?" Mr. Strauss responded:
"...there is no way to design a tamper proof program. If prudent procedures are not followed in running it, any program can be compromised. The NBS publication Effective Use of Computing Technology in Vote-Tallying makes this point very clearly and provides reasonable guidelines for designing and running vote-tallying programs." [7]
These qualifying remarks were not reported in the New York Times article.
Professor Clemons was quoted in the July 29, 1985 article as saying that because of the excessive complexity of the program,
" '...a doctored version of the code could be used to modify election results, and it would take weeks of study to determine what had happened.'
" 'Code this complex is very difficult to trust,' Mr. Clemons said. One particular flaw that he cited was that 'the main program does not log all invalid ballots.' Another was that the printed log of error messages could easily by edited or altered."
An examination of the complete text submitted by Professor Clemons to the New York Times shows that he also stated that:
"This does not mean that the code was constructed this way in deliberate violation of [FEC Clearinghouse] recommendations or current practice; this was a very common programming style in the 60s and mid-70s. And it does not mean that anyone is using the system to influence election results." [8]
These qualifying remarks, similarly, were not included in the New York Times article.
The July 29, 1985 article was distributed by the New York Times News Service, and also appeared, in whole or in part, in other papers, including the Greensboro (NC) News & Record and the Norfolk (VA) Virginian-Pilot.
Another article in the series, on August 21, 1985, entitled "Vote by Computer: Some See Problems" [9], reported that:
"Many local election officials are baffled by computers and are unable to understand, question and challenge the computer systems.
"Election system vendors are often forced by competitive bidding pressures to offer jurisdictions the cheapest possible systems, and the products they offer do not maximize fraud protection."
In explanation, the article continued:
"The industry has been faced with competition to produce low-cost systems that can produce a quick tally, but it has not devoted much attention to devising systems that could be understood by local officials and that would provide features such as audit trails to make fraud difficult."
2.7 California Attorney General's Report
In December, 1985, the Office of the Attorney General of the State of California began a study that was "prompted ... by several nationally published news stories" [10], by which the New York Times series was meant. The study concentrated on "an analysis of the nature and extent of reported problems attending the computerization of the vote counting process" [11]. Almost every county in California uses computerized vote-tallying systems, and the systems include a significant number provided by the vendor named by the New York Times.
The report, on April 23, 1986 by Robert R. Granucci, Deputy Attorney General, might be summarized with the following quote:
"My general conclusions are that while there have been no proven instances of vote counting fraud, certain concerns that have been expressed about the security and accuracy of computerized elections appear to have validity. However, these concerns are receiving serious attention and improvements are being made. A principal concern is that the most widely used vote counting software has been criticized for lacking a reliable audit trail and having a program structure that is very difficult even for computer professionals to understand.
"It appears that most of the reported problems associated with computerized vote counting have occurred the first time the system is used by local election officials, and decrease in later elections. If experience is any guide, inaccuracies in tallying election results will tend to diminish as local election officials gain familiarity with electronic systems, but the potential for fraud may tend to increase.
"The Attorney General should urge the Secretary of State to require that all electronic vote tallying systems have reliable, tamper-proof audit trails." [12]
(Note: compare final sentence above with Strauss quote in section 2.6 that "...there is no way to design a tamper-proof program. If prudent procedures are not followed in running it, any program can be compromised" [7]. It would seem that the essential need is for "prudent procedures.")
The Attorney General's report was publicized by the San Francisco Examiner in an article on October 20, 1986. The article reported that, according to the Secretary of State's office, which regulates elections, "in 25 years, no error has affected the outcome of a California election." However, there have been "sporadic glitches," the article reported. Several examples were given: in San Francisco in 1983, "an electrical power fluctuation during the vote count" added votes incorrectly to one candidate's totals; in Orange County in 1980, "a computer programmer's mistake" gave about 15,000 votes meant for two candidates to two other candidates; and in San Joaquin County in 1984, "a misplaced piece of punch card caused the system to indicate that one precinct had not been counted when it had been." [13]
The article also reported that:
"'Rigging a computer vote would require a conspiracy of six to eight people,' said Deborah Seiler, head of the state secretary of state's computer voting division. 'The greatest possibility of error that I'm aware of is human error,'" she said.
"San Francisco Registrar [Jay] Patterson said that many election offices depend on manufacturers and county data processors to operate the systems. 'That certainly is not the best of situations when the person responsible for the vote count is not actually involved in it,' said Patterson.
"Some counties with 'sloppy procedures' have failed to test computer equipment as required by the state, according to Robert Naegele, a technical consultant to the state and the Federal Election Commission. Each county must run 'logic and accuracy tests' of its system before and after the vote count." [13]
2.8 Texas Controversy, Hearings, and Legislation:
1986/1987
2.8.1 Controversy Over 1985 Dallas Mayoralty Contest
Following the April, 1985, Dallas mayoralty contest, Ms. Terry Elkins, campaign manager for losing candidate Max Goldblatt, approached the office of the attorney general of Texas with concerns about the manner in which the election was conducted. The attorney general's office asked a consultant to carry out an investigation. As a result of the investigation, Assistant Attorney General Robert L. Lemens wrote a letter to Ms. Karen Gladney, Director of Elections for Texas. The letter, on July 15, 1986, included the following statement:
"...although [the consultant] has insufficient evidence to conclude that fraud has been committed, the electronic voting system in use lacks adequate security features to provide any assurances of the absence of fraud. As a result, this office has found that it will be difficult to demonstrate to the complainants that Texas elections are free from fraud and, thereby, free local election officials from suspicion." [14]
Further investigations followed by both the office of the attorney general and the office of the secretary of state (the latter included Ms. Gladney's office). On September 23, 1986, the Dallas Morning News reported the following story:
"The state attorney general's and secretary of state's offices are investigating discrepancies found in the computerized voting records of several recent Dallas and state elections to determine if the results may have been obtained fraudulently...
"The probe centers on allegations that computerized voting equipment and computer programs used to tabulate state and local elections may have been tampered with to bring about 'preprogrammed results,' [Attorney General Jim] Mattox said....
"Terry Elkins, who managed [Max] Goldblatt's [1985] bid against [incumbent Mayor of Dallas Starke] Taylor, said ... that she has given to state officials 18 months of research documenting the discrepancies [in the 1985 mayor's race]. Chief among the discrepancies, she said is a claim that there were more votes cast than there were voters' signatures.
"'The allegation is that the computer used to count the votes was given new instructions after it calculated that Max Goldblatt was leading Starke Taylor by 400 votes,' Mrs. Elkins said." [15]
(Note: A detailed discussion of vote-tallying problems in the Dallas 1985 mayoralty election is given in section 4.3.)
The following day, September 24, 1986, the Dallas Times Herald reported this additional information:
"[Attorney General] Mattox said [on September 23] that the investigations call into question the ability of local city and county elections officials to vouch for the integrity of their elections when they use the automatic vote-tallying system.
"The punch card system, which uses a computer to count ballots marked by voters, is so complex that election fraud could go unnoticed, Mattox said.
"'I would say that the system appears not to have the kind of safeguards that election authorities would like to have to give them the independent capability to judge whether there has been fraud in an election,' he said.
"'It would not be easy even for a computer expert to determine that there was fraud,' he said." [16]
2.8.2 Texas Secretary of State's Directive
As a result of the uncertainties created by the charges of vote fraud, and the ensuing investigations, the Secretary of State of Texas issued a directive on October 14, 1986 detailing additional security procedures for computerized vote-tallying to be used by county clerks and election administrators. The provisions of the directive were directly responsive to identified deficiencies in vote-counting procedures. Some of the provisions are as follows:
"Under no circumstances may the computer-generated printed log of computer activity that occurs during the tabulation be turned off. The log must record all operator commands and inputs to the system from any device. The log must indicate for each precinct the to-tal number of ballots that are entered into the central computer.
"Each page of the log must reflect the correct time of day.
"Each [of at least three cumulative reports produced throughout the tabulation process] shall include ...the number of over votes and under votes in each race.
"... a computer-generated report that indicates the number of ballots cast in each precinct [shall be prepared].
"... the secretary of state may order a manual count of ballots cast in the election to ensure the accuracy of the count." [17]
2.8.3 Legislative Hearings
On November 25, 1986, the Texas House of Representatives Committee on Elections, chaired by Representative Clint Hackney, held a hearing on possible changes in the election laws of Texas related to computerized vote tallying. Statements made by testifiers concerning the general problems of computerized voting included the following, by the indicated individuals:
Dr. Michael Ian Shamos, computer scientist, and one of three statutory examiners of electronic voting systems for the Pennsylvania Bureau of Elections:
"Punched-card systems have two significant positive features. One is that they cause a permanent physical record to be kept of every ballot cast....A second positive aspect is that cards can be counted very rapidly....
"...punched-card systems have no other redeeming features and in fact present great dangers. These are[:]
"...the ballot itself contains no candidate names and is meaningless when examined. This problem greatly increases voter confusion....
"The voter is unable to determine whether he has cast a complete ballot or whether he may have voted for more candidates that he is entitled. An overvote will result in an invalid ballot, and the voter's legitimate choices will go uncounted....
"It is a straightforward matter to alter a punched-card voting booth so that votes cast for one candidate will be recorded as though they were for another....Any required tampering can be performed during the election and all traces removed before any investigation can occur....
"....the computer hardware and software used to tabulate the ballots is subject to tampering. Furthermore, such tampering is relatively easy and invisible....Computers can be manipulated remotely, by wire or radio, or by direct physical input. The memories on which these computers operate can easily fit into a shirt pocket and can be substituted in seconds. The software can be set to await the receipt of a special card, whose presence will cause all the election counters to be altered. This card could be dropped into the ballot box by any confederate. The possibilities for this type of tampering are endless, and virtually no detection is possible once tabulation has been completed....
"Even if the software is not altered, there is no reason to believe that it is correct. Many tests performed on such programs have revealed faulty logic and wildly incorrect results.... Many jurisdictions, such as Pennsylvania, have complex rules for counting such situations as cross-filed candidates in vote-for-many offices and it is stretching to believe that an election system vendor would be aware of all such combinations of conditions to have produced perfect software. It is axiomatic in the computer industry that all large computer programs contain errors, and the more extensive the software the more errors it contains....
"When one company or a conglomerate of companies supply unauditable software from a central distribution point, or participate directly in ballot setup procedures, there exists the possibility of large-scale tampering with elections. An errant programmer or tainted executive could influence or determine the outcome of a majority of election precincts in the country...." [18]
Ms. Suzan N. Kesim, vice-president of a security consulting firm of South Bend, Indiana:
"The program for counting elections should use structured programming techniques. A detailed flow chart of the program should be required [to be submitted]....
"Whether you are adding dollars or votes, you can apply many of the same auditing standards.... Many of the computer auditing procedures used by the banking industry that have been tried and true could easily be modified or used as they are for auditing elections....
"Pre-punching the ballots with the precinct could be a really crucial way of checking and making sure that ballots don't slide from precinct to precinct....
"Fraud possibilities include 'hidden programs'....
"Write a public domain software program to count votes, open to public scrutiny...." [19]
Anita Rodeheaver, County Clerk, Harris County (Houston), Texas:
"A computer, whether it is in a bank or a hospital or a collection agency, or being used for elections, is only as good as the people that run it....
"It upsets me when continually we work so hard to have good honest elections and we continually get hit with things that could happen or 'supposedly are happening,' but no one ever comes up with any concrete evidence that they did happen...." [20]
Tom Eschberger, Vice-President of Business Records Corp.:
"In twenty years, I have seen two cases of attempted fraud on an election system. I saw one in Albuquerque, New Mexico on lever machines, and one in Pueblo, Colorado attempted on punch cards. I have personally run about one thousand elections around the country.... Those were the only two cases where I was convinced that somebody had tried to defraud somebody.
"I have seen a lot of cases where people make dumb mistakes, where the totals don't add up.... Elections are run by amateurs. [Other than experienced election administrators,] there are 400 people out in the precincts who got just a one-hour training class. People are not going to have perfect elections. People are going to have the best elections that well-intentioned honest people can run, and that well-intentioned honest companies can run....
"A lot of counties want us to do the programming for them because it disassociates them from any candidate and any accusation of fraud or collusion.... [Persons intending to commit fraud would] have to have our source code, they would have to have collusion with somebody in the county, they would have to have access to the computer....
"[Filing the program with the secretary of state] might set some minds at ease. Then, someone could look at the code and know what's going on in an election if there were a problem. If someone said there was fraud and here's how they did it, then you have someone at the State level who is familiar with our source code that could say yes or no. Yes, it would be beneficial from that standpoint." [21]
Warner Croft, a partner in the public accounting firm of Arthur Anderson and Company:
"We do believe the election laws need to be codified to reflect the technology being employed today in the election process.
"We do believe that the Secretary of State needs to have the authority and the money to enforce those laws, to make sure that the proper audit trails are in place, so that whenever allegations do surface, ... the records are in place so that the State can, with a minimum of time and effort, go to those records and find out what happened.
"Unfortunately, the laws at this time are a bit too nebulous for that to be done....
"As long as there are winners and losers in elections, regardless of the system being used, there will be these allegations. You cannot legislate this problem away by requiring a higher generation of technology, another language.
"But what we can do is require an audit trail, so that the documents that represent the voter's intent are kept on file, for a predefined minimum period of time, so that no matter what went on inside the computer, we've got a source that we can go back to, to determine what the voter actually did...." [22]
2.8.4 Revised Texas Statute on Electronic Voting Systems
A revised statute on the use of electronic voting systems was passed by the Texas legislature and was approved in June, 1987 [23]. It took effect on September 1 of that year. Some of the revisions concerned the following topics:
Auditing: A voting system may not be used unless it is capable of providing records from which the operation of the system may be audited.
Deposit and Comparison of the Program: Copies of the "program codes" and related documentation must be filed with the secretary of state. The secretary of state must periodically compare the materials on file with those materials actually used to ensure that only approved materials are used. The software on file is not public information, although it may be made available to the attorney general for investigation of irregularities.
Use of Remote Terminals: Computer terminals located outside the central counting station must be capable of "inquiry functions only" during vote tabulation, and "no modem access to the tabulation equipment" must be available during tabulation.
Testing of Equipment: Each unit of tabulating equipment shall be tested "using all applicable ballot formats."
Discrepancies in Ballot Totals: If, in the use of a precinct-located computer, a discrepancy of more than three exists between the number of ballots recorded by the computer and the number of ballots written down by the precinct officials, the final count of that precinct shall be done centrally.
Manual Count: A manual count of all the races in one percent of the election precincts, but in no less than three precincts, shall be conducted at the local level. The secretary of state also may conduct a manual or automatic count of any number of ballots. No specific ground for obtaining an initial recount is required.
As a result of passage of the revised statute, all electronic voting systems now certified for use in Texas will need to be decertified. The revised statute specifically addresses some of the problems of computerized vote-tallying identified immediately below.
2.9 Current Problems Of Computerized Vote-Tallying
Current problems of computerized vote-tallying, including those identified by those who have recently made public statements or produced public documents, are summarized by the following categorizations. The relationship of the recommendations of this report to these problems is discussed in section 6.18.
2.9.1 Difficulty in Verifying Results
Results of elections announced by election officials are difficult to verify. The problem of verifying results is due to:
(a) lack of audit trails;
(b) poor design of computer programs;
(c) vendor-supplied computer programs that are unavailable to the scrutiny of responsible officials;
(d) administrative procedures that are incomplete and poorly implemented, resulting, for example, in the inability of observers to successfully compare computer reports of ballots cast with the same data reported by precinct officials.
2.9.2 Possibility of Undiscoverable Frauds
The lack of internal controls and failure to implement computer security increase the possibilities that unknown persons may perpetrate undiscoverable frauds. Methods of forcing incorrect results include:
(a) fraudulent alterations in the computer program or in control cards that manipulate the program;
(b) activation of a hidden program, possibly by means of a time-of-day match or with a specially encoded punch card ballot;
(c) manual replacement of the computer program by a fraudulent substitute;
(d) introduction of false ballots into the set of real ballots, through either addition or replacement; or introduction of false ballot data through interchange of ballots, by a perpetrator taking advantage of different ballot styles;
(e) introduction of false voting summaries through changes in data stored in removable data storage units of precinct-located, vote-counting devices;
(f) fraudulent alteration of the face of the voting device used by the voter at the polling location to mark a ballot or indicate choices;
(g) fraudulent alteration of the logic of precinct-located, vote-counting devices.
2.9.3 Election Administrators' Lack of Knowledge and Resources
Some election administrators have a lack of knowledge about computers, and they lack the necessary knowledge and resources to effectively negotiate with vendors. The effect of these deficiencies are:
(a) administrative errors in conducting elections, with increased potential for fraud or, at minimum, loss of public confidence;
(b) abdication of control over elections to vendors and county data processors, with the resultant inability to impose the necessary internal controls;
(c) inability to require vendors to provide computer programs, election equipment and supplies that include adequate safeguards against fraud and inaccurate reporting;
(d) increased risk to vendors in entering a market fraught with the potential for negative publicity, resulting in reduced competition and reduced investment in improved products;
(e) slower than adequate introduction of more effective technology.
3. TYPES OF VOTE-TALLYING SYSTEMS, THEIR VULNERABILITIES, AND THEIR
NATIONAL DISTRIBUTION
3.1 Vote-Tallying As Part Of Voting
Voting, as it is carried out in the United States today, may be said to consist of four distinct administrative steps. These are:
(1) voter authorization: the determination of whether the prospective voter is entitled to vote at a particular place, and for what set of offices and issues;
(2) secret choice: provision of the opportunity for the voter to express his or her choices without intimidation:
(3) precise recording of the expression of each voter's choices in a voter-disconnected and easily countable format; and (4) accurate summarization of all voters' choices by candidate and issue alternative.
Vote-tallying, a subset of voting, consists of steps (3) and (4), although the process involves concern for steps (1) and (2).
3.2 Paper Ballots
The uniform use of an official ballot containing the names of all candidates, printed on uniform paper by public officers at public expense, and distributed only at the polls where it is marked in secret, was adopted first in the Australian state of Victoria in 1856. In the years immediately following, the concept was adopted in other Australian states. Thus, it came to be called the "Australian ballot" [24]. The Australian ballot concept was the first successful attempt to meet the requirements of steps (2) and (3) above.
The Australian ballot had its first U.S. statewide application in New York in 1889, and was adopted widely throughout the Nation in the next decades. Prior to that, the application of the secret ballot was limited. In many cases, persons had to announce their votes publicly, or tell them to a sheriff who recorded them. In other cases, there were party-specific paper ballots, produced with different colors or weights of paper to reveal party choice.
During the early years of introduction of the Australian ballot, there was considerable controversy over whether the information on the ballots should be arranged in a "party" format (the set of all candidates of a single party listed together), or in an "office" format (the set of all candidates for a single office listed together). At present, most ballots are designed with an "office" format. However, in many states, voters are permitted to select all candidates of a particular party with a single "straight party" vote, with an allowance for "crossover" votes for specific candidates of any other party.
Paper ballots remain in use today in small communities and rural areas by about eleven percent of U.S. registered voters (see section 3.9.2 for the percentage of use of the various system types by counties and by registered voters).
3.2.1 Vulnerabilities of Paper Ballots
When effective administrative controls are not applied, paper ballots are subject to possible fraud and error in their distribution, in their use at polling places, and in counting.
Ballot frauds: Failure to properly account for ballots distributed may provide the opportunity for fraudulent addition of extra ballots into the ballot box, an activity generally referred to as "ballot stuffing." In places where votes are bought and real ballots are not sufficiently distinctive, voters may be handed pre-voted counterfeit ballots before entering the polling place. As an alternative fraud, voted counterfeit ballots may be substituted for real ballots already voted.
Chain voting: When administrative controls at the polling location are poorly implemented, and enough voters are willing, chain voting is a possibility. In chain voting, the first voter in the chain retains the unnoted ballot given to him at the polling place and, instead of voting, takes the ballot outside. This voter loses his vote, but starts the chain. Outside, a party worker fills out the ballot and hands it to a second voter who has also agreed to participate. The second voter turns in the voted ballot, but retains the unnoted ballot handed to him in the polling place for return to the party worker outside. Successive voters who participate receive a pre-voted ballot and return an unnoted ballot to the party worker.
Malicious invalidation: In counting paper ballots, extra marks may be made on ballots intended for an opposition candidate, thereby subjecting those ballots to invalidation in jurisdictions where extra marks are cause for that result. (Extra marks are often cause for invalidation because such marks may be used to indicate that a private agreement has been carried out in which a voter has agreed to vote as instructed in return for some consideration.)
Inaccurate counting: Hand counting of large numbers of paper ballots is generally inaccurate, because of human inattention and fatigue, compared with counting of machine-readable ballots.
3.3 Lever Machines
The first use of mechanical lever-type voting machines was in Lockport, New York in 1892 [25]. In the use of these types of machines, hereinafter referred to as "lever machines," each candidate or issue alternative is assigned a particular lever of a rectangular array of levers on the face of the machine that is seen by the voter. The levers are horizontal in their unnoted positions. The array of levers may be arranged with offices from right-to-left and parties from top-to-bottom, or vice-versa. A set of inserted printed strips visible to the voter identifies the lever assignments.
On entering the area of the machine (the "voting booth"), the voter enables the machine with a handle that also closes a privacy curtain. Then, in order to indicate choices, the voter pulls down selected levers. When the voter exits the voting booth by opening the privacy curtain with the handle, the levers are automatically returned to their original positions. As each lever returns, it causes a connected counter wheel within the machine to turn one-tenth of a full rotation. The counter wheel, serving as the "units" position of the numerical vote count for the associated lever, drives a "tens" counter one-tenth of a rotation for each of its full rotations. The "tens" counter similarly drives a "hundreds" counter. If all the mechanical connections are fully operational during the voting period, and the counters are initially set to zero, the position of each counter at the end of the voting period indicates the number of votes that were cast on the lever that drives it.
By 1930, lever machines had been installed in Denver, Milwaukee, Minneapolis, Newark, New York City, Pittsburgh, Philadelphia, and San Francisco [26]. One reason for the acceptance of the machines was the existence of significant fraud in the use of paper ballots. By the middle 1960s, just before the introduction of punch card voting, almost all large cities and many medium-sized ones used lever machines. It is likely that, at that time, over one-half the votes in the Nation were being cast on lever machines (now slightly more than one-third).
Lever machines are precinct-located devices, that is, the basic vote-count is accomplished at a neighborhood voting location that may be remote from the place where the votes are summarized to determine the outcomes of the contests. The number of machines at each location depends on the number of persons expected to vote there and the expected average time for a person to cast a complete set of votes. Separate machines may be required for each party in a primary election (conceivably, only part of the machine could be made operable for a voter of a specific party, with another part reserved for another party) and for each precinct voting at the same location.
3.3.1 Summarizing Lever Machine Results
After the close of the polls, the backs of the machines are opened. The number of votes is read off each of the counters, and each number is transcribed to official documents. Recently manufactured lever machines may allow for printing of the counter values on request. The official precinct documents are carried to the central vote-counting location for summarization.
With lever machines, only summarized voting results are available at the precinct level. No individual choices are available to be counted. Interlocks in the machines prevent overcoming (voting for more than the allowed number of candidates in a contest, e.g., voting for three candidates in a vote-for-two contest, such as for school board). There can be undervotes (voting for less than the allowed number of candidates in a contest, e.g., voting for one or no candidate in a vote-for-two situation).
3.3.2 Vulnerabilities of Lever Machines
With a lever machine, there is no ballot, i.e., no independent verification of each machine's recorded result. While the lack of ballots eliminates the possibility of chain voting, counterfeit ballots, and spoiling of the opponent's ballots, there are other possibilities for fraud or error, some available because there are no ballots.
Vote count frauds: The lever-machine equivalent to "ballot stuffing" is the casting of extra votes on the machine by party workers. When there is no genuine bipartisan staffing of a precinct polling place, any type of vote-tallying system is more easily subjected to fraud.
No audit trail of voter's intent: One effect of the unavailability of ballots is the lack of a true audit trail. No unequivocal distinction between an undervote and a machine failure can be made solely with a review of the vote counts. If the number of votes cast for an office is less than the number of persons that have voted on the machine (often indicated by a "public counter" that may be connected to the voting handle), then for each undervote, there are the following possibilities for a contest involving two candidates: either the voter failed to vote for either candidate, or the counter mechanism failed to turn for the voter's choice.
In general, it is not possible to determine which one of these possibilities is the correct one for any single undervote without a review of the internal condition of the machine. If a counter mechanism failed to turn, it may be due to an actual disconnect in the mechanical system, or it may be due to excessive friction in the connections. If a vote total reads 000 or some number up to 009 when many more might have been expected, a mechanical disconnect is a strong possibility. If a vote total reads 009 or 099, the possibility is increased that excessive friction at the point of highest mechanical resistance to turning (during an arithmetic carry operation) caused a failure. If the counter failed to turn correctly for any reason, there is no independent ballot available to verify the count. The voter's choices are lost, absent a court order for a new election.
No true recount capability: In a lever machine contest, a "recount" simply means that the precinct transcriptions are reviewed to determine if any precinct official erred in copying down the counter values or the precinct documents were fraudulently replaced on the way to the central summarization location.
Write-in difficulty: Another problem with lever machines is the difficulty of indicating write-in votes. The lever machine is not oriented towards individual idiosyncratic choice, but only choice from the available menu. If State or local law requires it, a roll of paper is made available with the machine for use by a voter in writing a name not available on a lever. However, the selection and use of this mechanism is noisy, and it is obvious to those around the voting area that a write-in vote is in progress. Since only a small number of voters may choose this possibility, privacy may be completely lost by those individuals in that instance.
Mis-labeling: A possibility for error or deliberate fraud is the insertion of incorrect identifying strips on the front of the machine, so that the levers are mis-identified to the voters.
Storage and transport: Lever machines are large and heavy, and therefore difficult to transport and expensive to store (compared with precinct-located electronic machines).
Setup errors or frauds: "Programming," i.e., pre-election setup with interlocks, requires specialized knowledge and is labor-intensive. Furthermore, the necessary specialized knowledge is not directly translatable to a variety of other work, for the support of the machine technicians between elections. As with any other situation where specialized knowledge may be employed for honest or dishonest purposes, the possibility of collusion involving lever-machine "programmers" must be considered.
Difficulty in operability verification: It is difficult to statistically test the correct operation of a lever machine by applying a large number of test votes. A lever machine is operated by direct human action, and the use of human labor to insert a statistically significant number of test votes to each counter would be expensive and error-prone. To effectively accomplish a statistical test of correct operation, a mechanism would need to be constructed that could vote on each lever a large number of times with an electromechanical drive that could be programmed. The mechanism would check the following: the single-vote recording operation of each counter, proper implementation of vote-for-more-than-one setups, overvote prevention, and proper operation of the arithmetic carry mechanism.
3.4 Punch Card Voting
Voting systems based on punch card ballots began to be used in the middle 1960s, and received considerable application in the western part of the U.S. by 1972. At that time, about 10% of U.S. voters used punch card ballots to record their choices [27] (but now, almost 45% use one of the two principal types of cards).
The introduction of punch card voting was an economic choice of many communities in their efforts to provide election services to an expanding population. Voting with punch cards does not require serial processing of many voters through a single voting station containing a complex machine. Several voting stations may be made available in one precinct with much less expense.
In the late 1960s and 1970s, punch card input of data to mainframe computers was commonplace. Punch card stock and punch card reader technology were widely available. American national standards, developed to specify the size of the cards [28] and the arrangement of holes in each card [29], were available to be adopted for punch cards used in voting.
The standard punch card has 960 potential punch locations arranged in 80 columns by 12 rows. In common business use, each column on a card represents one character (such as a letter of the alphabet or decimal digit). A standard data code for business use of the punch card has been developed, and it is called the Hollerith code [30]. In this code and in its recent extensions, a graphic character (a character seen in printed text) typically requires no more than three holes in a column to represent it. For each unique character, the holes representing it form a correspondingly unique pattern. When the pattern of holes in the twelve locations in one column is read by a card reader and converted to a sequence of 1s and 0s in a computer (e.g., 1 for a hole and 0 for no hole), the sequence may be recognized as the unique character by a computer program.
When the standard punch card is to be used to record votes, it is necessary to permit more variability in the use of punch locations than the Hollerith coding system allows. When any number and arrangement of holes in a single column are permitted, the coding system is called "column binary." However, not every location on the card can be used for voting. This restriction is generally due to ballot layout considerations, but some consideration must be given to the physical strength of the card when it is used with more intensive layouts. A further limitation on the use of punch locations is necessary if information about the candidates and issue choices is to be printed on the card.
3.4.1 Vulnerabilities of Punch Card Use
Punch card ballots have all of the vulnerabilities of paper ballots that are related to distribution, precinct use, and collection. Administrative controls may be implemented to prevent the typical paper ballot frauds. Most of these controls have been previously identified [1], and are proposed again in section 6.16.
Manufacturing requirements: Accurate dimensioning in manufacturing, and use of materials consistent with the needs of punch card readers, are additional requirements unnecessary for paper ballots.
Ballot-reader requirements: Accurate ballot reading is of fundamental importance in a punch card system. Assurance should be obtained, in both pre-election and post-election checkout, that the readers are correctly reading the ballots. In addition to the question of accurate recording of voters' selections, difficulties in ballot processing may include card jams, transport of more than one ballot at a time, and the inherent problem of pre-scored cards. If a card jams in the reader, it is essential to know whether or not the card was counted; otherwise, either the card and its votes may be counted twice, or not at all. Transport of more than one ballot, similarly, may cause a miscount of the cards as well as inaccurate reading. (The reader can accurately read only one ballot at a time.) The problem of pre-scored cards is considered in sections 3.4.3 and 3.4.4.
3.4.2 Types of Punch Cards
Two common types of punch cards used for voting may be distinguished. These are designated in popular usage as the "votomatic" card type and the "datavote" card type. As used by a voter, a card of either type is positioned with the long edges on the right and left, and the short edges at the top and bottom. Thus, each column is horizontal, and each row is vertical. The card is usually issued to the voter with a numbered stub attached to the top short edge. The line of attachment is perforated for easy removal of the stub. In most cases, the stub is removed immediately before the ballot is submitted; it may be removed by a precinct official while the voter's choices are covered by an envelope or other holder. One use of the number on the stub is to assure that the ballot voted is the same one issued to the voter.
"Votomatic" card: With the "votomatic" card, the locations at which holes may be made to indicate votes are assigned numbers. The number of each hole is the only information printed on the card. This type of card maximizes the number of voting locations available. As there is no space on the card for names, names of write-in candidates must be written by the voter on the envelope provided to the voter with the card. In the tallying process, each envelope must be examined before the card is removed; each card and its envelope with write-ins must be put aside for separate processing. The envelopes with write-ins cannot be separated from their ballot cards until the cards are reviewed for overvotes.
In the 312-position "votomatic" card, every third column is used, beginning with column 5 and ending with column 80. This allows for 26 usable columns which, when combined with 12 rows per column, provides for 312 positions. There are also 228-position and 235-position cards available. Only one side of the "votomatic" card is used. The "votomatic" card (when separated from any attached stub) is generic for any election, as it only has numbers on it.
"Datavote" card: With the "datavote" card, the name of the candidate or description of the issue choice is printed on the card next to the location at which the hole is to be punched to indicate the choice. Fewer voting locations are available on the "datavote" card. However, the "datavote" card provides a particularly simple write-in capability, as a separate blank candidate line in each contest may be provided for that purpose.
For the "datavote" type card, the locations used for voting are in a row close to the righthand long edge of the card. Spacing of two or more columns between voting locations is required to allow room for the printing of the candidate name or issue choice description. Typically, the card may be turned over (with its long dimension as an axis) so that the other long edge is on the right. Then, the other side of the card and a row close to the second long edge may also be used to provide voting locations.
3.4.3 Voting With the "Votomatic" Card
A voter uses the "votomatic" card for voting by first inserting it (with its attached end stub) in a hollow mechanical holder. (The holder is often called a "votomatic device" or "vote recorder.") The stub contains two holes. The card is properly positioned when the holes in the stub are fitted over two small posts on the device. The holes are asymmetrical in the stub to prevent the voter from inserting the card so as to show its reverse side. The system was developed from a concept introduced by Dr. Joseph P. Harris, whose early book on election administration has been previously referenced [24], [25], [26].
Compared with the lever machine, the mechanical holder is inexpensive. Many more holders could be used in a precinct for the same cost, and therefore, more voters may simultaneously vote.
A hinged booklet is attached to the mechanical holder. The booklet is attached so that it is centered over the inserted punch card. The pages of the booklet are crimped to a hinge, as it is necessary that the pages not be removed during the voting process. The attachment permits the exposure of only one row of the punch card to the view of the voter at the axis of the booklet. As the pages are turned, a different row of the punch card is exposed for each page. All voting instructions, such as office names, candidate names, candidate punch positions, and allowable number of votes per office, are presented on the pages. (In some cases, the pages are simply transparent envelopes and the ballot information is provided on inserts within the envelopes. In those cases, the envelopes are sealed following insertion of the ballot information.) The names of the candidates and issue choices must be positioned on the pages so that each is next to the appropriate voting location on the card.
A vote is cast by creation of a hole in the punch card at the desired location. Almost all unnoted "votomatic" cards are pre-scored, i.e., each voting location on the unnoted card is scored in the shape of a rectangle. Sufficient pressure on the voting location with a hand-held stylus forces out the inside of the rectangle, identified as a piece of "chad." The need for pre-scoring is due to the simple nature of the stylus and the inability of the voter to otherwise form a hole of the dimensions required for processing through a ballot reader.
Recently, a new type of stylus has been introduced: one which does not require a pre-scored card. The new stylus has a spring-loaded sleeve. The sleeve provides sufficient force to punch out pieces of round chad with a diameter acceptable for processing, without the need for pre-scoring. The new stylus is used with the same type of "votomatic" ballot holding device as that used for pre-scored cards, but with a change in the device's internal construction. Precise manufacturing of the new internal "templates" that guide the stylus is required. This type of system has been used successfully in St. Lucie County, Florida. St. Lucie has about 400 ballot holder units constructed for use with the new stylus.
3.4.4 Vulnerabilities of the "Votomatic" System
Some vulnerabilities that are special to the "votomatic" system include the following: the lack of candidate information on the card itself, the need of the voter to turn over all the pages of the booklet to get all available voting information, possible misalignment of the candidate information on the page with the appropriate voting location on the card, the possibility of malicious alteration in the voting instructions on the pages, and the problem of chad in pre-scored cards.
Lack of candidate information on the card: The fact that the "votomatic" card only has numbers on it results in a lack of an obvious relationship to the candidate selected, once the voted card is removed from the mechanical holding device. However, each hole is numbered, and the instructions on the pages identify each candidate and issue choice by the corresponding hole number. In jurisdictions that use the system, campaign advertising may specify the hole number of the desired choice (although rotation of candidate sequence in different districts prevents candidates running in multiple districts from having a universal card location).
In absentee voting, the voter typically does not have a ballot holder available. The voter must find the number of the candidate or issue choice desired as listed on the instructions, find the number on the ballot that matches the number of the candidate, and punch out the corresponding chad.
Clearly, the system is not as user-friendly as a ballot or display containing the candidate names, on which each vote is cast next to the desired name, but the "votomatic" system may have been selected because of economy, or the presence of a very long list of contests, for which no viable alternative voting system exists. In California, each voter receives a sample ballot in the mail. Knowledgeable persons in that state believe that this procedure significantly improves the voter's ability to correctly use the system.
Need to turn over all pages: The voter must turn over all the pages of the booklet to obtain all necessary instructions and to permit each voting location to be available for punching. Some voters may forget to do this and lose their franchise for some contests and issues. When the number of candidates for a single office is very large, the voter may be forced to look on successive pages to find the total list. Confusion about voting for such a contest may result. If the "votomatic" system is selected for other compelling reasons, voter education is the only method of assuring voter understanding of the voting process.
Failure of information alignment: If assembly of the mechanical holder and the booklet is inaccurate, or the location of printing on the pages is imprecise, the candidate information on the pages may not correspond exactly to the appropriate voting location. Voter confusion, about which hole to punch, will result.
Malicious alteration of instructions: It has been charged (see section 2.8.3) that the instructions on the pages might be altered by a particular voter, to the detriment of voters who follow and use the same mechanical holder. Even if the holder could not be easily taken apart by a voter and the pages replaced, certainly the instructions could be defaced or covered over with a stick-on label that supplies false instructions. A defense against this is alertness on the part of the precinct officials, but there are other defenses in place. One defense is that the perpetrator will have given his verified name and address. Secondly, the perpetrator may be observed if there is no privacy curtain; or a following voter may note the defacement or alteration, thus limiting the possible perpetrators to a small number. In addition, since many mechanical holder units are employed in a typical election, the damage done will have a very small effect, unless a massive conspiracy attacking many such units can be assembled.
Problem of chad in pre-scored cards: Pre-scored cards have presented some difficulties in processing. Either a chad may fall out unintentionally, or a chad that is intended for removal may not be fully removed. In either case, the voter's intent is not accurately recorded.
A chad that is not intended to fall out may be loosened in handling, or may be loosened in the processing of the card through the card reader. Lack of care in tearing off the stub of the card may loosen chad. Undesired removal of chad in reading may be more likely if the design of the reader mechanism requires the card to bend. If the card jams in the reader and is folded or bent, pieces of chad may fall out. Training of precinct personnel in card handling and stub removal, and careful selection of card readers, may alleviate this problem.
During voting, a piece of chad completely removed by the voter should fall into the mechanical ballot holder and cause no difficulty. However, in some cases, the voter fails to completely remove the chad. This problem may be due to one or more of several factors, such as: (a) the mechanical holder may have been constructed or assembled poorly, and the parts of the holder are not where they should be, (b) the materials are of poor quality, or certain materials used, e.g., rubber, may have deteriorated with time, (c) the voter may have inserted the punch card incorrectly into the mechanical holder, (d) the voter may attempt to punch out the chad with a less effective tool than the stylus, such as a ball point pen, (e) the voter may apply insufficient force, because of a physical infirmity or because the voter is unaware of the requirement for complete chad removal, (f) the dimensions of the punch card may not be within tolerances, or (g) the process of pre-scoring the card might have been done poorly.
A partially removed chad may be pressed back into the card during the stacking of the cards in preparation for reading, or during the reading itself. If the chad is pressed back, no vote will be recorded for that location, even if it was the intention of the voter to cast that vote. A chad that falls out during the reading process may affect the operation of the reader. Some election administrations provide "inspection boards:" bipartisan panels of persons who review each card before processing, and who remove hanging chad according to pre-established rules. This process also identifies write-ins, and catches the occasional malicious action, such as the attachment of chewing gum or other objects to a card. Extraneous objects may cause the card to stick in the card reader, or possibly damage the reader mechanism.
3.4.5 Voting With the "Datavote" Card
For voting on the "datavote" card, a stapler-like tool is used. The tool creates a hole instead of inserting a staple, and the tool provides sufficient force such that pre-scoring of the card is unnecessary. In order for the tool to be used, the card is placed in a holder which positions the row to be punched under the hole-punching part of the tool. The tool is mounted on the holder so that it can move up and down the row to the desired column. The holder is inexpensive, so that several may be used at one voting location.
3.4.6 Vulnerabilities of the "Datavote" System
With the use of the hole-punching tool, there is no problem of hanging chad. Since the candidate information is on the card, there is no potential for malicious alteration of voting instructions.
Multiple cards: As the "datavote" card provides fewer voting locations than the "votomatic" card, even when both sides of the "datavote" card are used, more than one "datavote" card may need to be issued to a voter. Additional cards require a certain additional expense. In using the "datavote" system, a voter may forget to turn the card over, or forget to use the additional cards, thereby losing part of the franchise. As with the problem of turning over the "votomatic" pages, voter education appears to be the only antidote.
When the number of candidates for an office is very large, both sides of the card may need to be used for the office. In rare cases, e.g., for voting for delegates to certain national party conventions, more than one card may be needed. In the latter case, all cards for the office from a single voter must be kept together, to identify overcoming.
Processing of multiple cards: When more than one "datavote" card is issued to each voter, more time must be allotted for processing the cards than for a single card per voter, or extra card reader capacity must be added.
3.5 Voting With A Mark-Sense Ballot
With this type of ballot, the voter makes a mark in a small rectangle or circle on a ballot to indicate a vote, and after the ballot is handed in, it is automatically read. Sensing systems originally employed electrical conductivity to determine if a mark had been made, but it is now much more common for light to be used. Thus, the system is often referred to as "optical scan," and is currently used by about seven and one-half percent of registered voters. Mark-sense technology is widely used also in standardized testing, for example for college entrance, and in statewide lotteries.
In the use of light as a sensor (or other part of the electromagnetic spectrum, such as infra-red), the beam impinges on the voting location, and the quality of the reflection of the beam is used to determine whether or not a mark is present. With the system employing infra-red, the voter is not limited to any particular writing instrument or pencil hardness, provided that the mark is not colored red.
Mark-sense ballots are typically not designed in the size, proportions, or thickness of the standard punch card. In most cases, they are larger, in order to allow for the printing of candidate and issue choice information directly on the ballot, while retaining just a single sheet as a ballot. As with the "datavote" punch card, separate blank lines may allow for write-in candidates. A numbered stub should be attached when issued, to permit proper accounting. No special holding device is required for use by a voter.
3.5.1 Vulnerabilities of Mark-Sense Ballot Systems
Mark-sense ballots, like punch card ballots, have the same potential for ballot manipulation frauds as paper ballots, and the same administrative controls may be applied as countermeasures.
Ballot-reader and ballot requirements: As with punch card ballots, accuracy of the reader is fundamental. The reader must be sufficiently sensitive to read the marks without being too sensitive so as to mistake smudges for votes. Similarly, if ballots are automatically fed, readers must be designed so as to transport only one ballot at a time. Jams of ballots in the reader must be adequately dealt with to assure accurate counting. Furthermore, printing of the basic control information (timing marks and voting locations) on the ballot must be precise. The needed precision may increase printing costs.
Treatment of reader-rejected ballots: Some mark-sense readers appear to have a problem in reading a fraction of the ballots (they provide a "go-no-go" indication) without any differences between the read and unread ballots being obvious to an observer. Ballots given a "no-go" indication by the reader may be separated by the mechanism and returned to the input, to allow for reentry. Rules for treatment of ballots unreadable by machine should be instituted to ensure that each voter's choices are counted, if the voter's intent can be determined (see section 4.9 for a pertinent example).
A positive feature of one reader implementation is that it returns the uncounted ballot to the voter if the voter has overvoted any office, thereby giving the voter a chance to eliminate the overvote.
3.6 Precinct Versus Central Count For Machine-Readable
Ballots
While voting on punch card and mark-sense ballots is carried out at precinct locations, counting of the votes may be done either at the precincts or at a central location. When voting with machine-readable ballots first started, there were no micro-computers, and all counting was done centrally. With the development of inexpensive small computers not requiring a special environment, the possibility of precinct counting of ballots became viable.
The selection of precinct versus central count is often a political decision, in which the desire for local control and decentralized decision-making is traded off against the higher costs for procurement, maintenance and support of many small machines. Local control appears to be important where there are strong neighborhood political organizations that believe that producing the tally locally, hopefully one that favors their party, assists in attracting committed individuals to the cause. The ability to see the tally produced and carry it to the central summarization location is seen as a reward for precinct service.
With counting at the precincts, unofficial results, obtained from a small removable storage unit of each machine, may be transmitted over telephone lines or hand-carried to the central location, thereby providing a rapid indication of the local outcomes. Los Angeles County, the largest local government jurisdiction in population, continues to use central counting, while Chicago, among our largest cities, uses precinct counting. In Chicago, summarized precinct results on removable data storage devices are hand-carried to regional centers, from which the data is transmitted over phone lines to a central location.
3.6.1 Vulnerabilities of Precinct Count and Central Count
The selection of precinct count or central count is a trade-off in vulnerabilities, as well as in other factors.
Central count: Uncounted ballots must be transported to the central location. The transportation of the ballots is an insecure process requiring effective controls.
The centralization of counting provides additional vulnerabilities, in the possible mixup of ballots from different precincts, and in computer operations. Often, a "header" card is added to the top of each precinct deck of ballot cards to be read. The use of "header" cards implies that the complete instructions to the computer are not already in the program, but are partially provided by these cards. Thus, it is important that the "header" cards, as well as all operator instructions to the computer, become part of the official records of the election. Backup computer components must be available to prevent total breakdown in a central count system. (See section 4.11 for an example of a partial breakdown.)
Precinct count: Machines have to be transported to precinct polling places at least one day before an election. These locations are relatively insecure against a motivated and dedicated adversary. At the polling places, there must be concern to prevent tampering as well as theft. A precinct-located machine usually has an EPROM (erasable, programmable read-only memory) that is inserted in it to specialize the machine for the particular ballot conditions in that precinct. Particular care must be taken to protect the EPROM against tampering, removal, accidental interchange with another EPROM, or replacement with an EPROM containing incorrect data. The EPROM may be attached with a seal to make tampering more difficult, and the EPROM may have data on it which will make it operative only if it is inserted in the machine for which it is intended.
Transmission of precinct results over telephone lines to a central location is a potentially inaccurate and insecure process requiring consideration of controls. Transmission of results needs no special security if only unofficial and summarized results are transmitted after the polls are closed, and connections are made only from the central station outwards. Encryption should be considered if individual choices or summarized results are to be transmitted before the polls are closed, or if the transmitted data is considered to be official. Other special hardware and software controls are required if dial-in connections are to be made. A useful analysis of security controls that may be used is available. [31] To assure accuracy of transmission, provision for parity checks and retransmission in case of error should be included in the communications equipment acquired for this purpose.
3.7 Direct Recording Electronic (DRE) Machines
This type of machine, the newest entry in applying computer techniques to voting, is an electronic implementation of the lever-machine concept. This system type is currently used by slightly more than two and one-half percent of U.S. registered voters.
As with a lever machine, there is no ballot; the possible choices are visible to the voter on the front of the machine. The voter directly enters choices into electronic storage in the machine with the use of a touch-screen, or pushbuttons, or similar devices. If an alphabetic keyboard is provided with the voter-choice entry device, write-in possibilities are significantly eased.
The voter's choices are stored in the machine and summed there with all other voters' choices. At the close of polls, summaries from all machines are then combined to yield final results. (If the machine simply produces a ballot to be reviewed by the voter for correctness, and then the ballots are tallied to produce the final count, the machine cannot be categorized as DRE.)
The determination of the number of individual DRE machines required at a particular location requires the same type of considerations as for lever machines. As a DRE machine essentially consists of a voter-choice entry station and a computer to summarize choices, an implementation using several voter-choice entry devices and one computer is possible. In the latter system, several voters simultaneously use individual entry devices to record their votes. Votes are summarized in a single computer installation that serves all such devices at the precinct.
As with lever machines, overvotes are prevented on DRE machines, but undervotes are permissible. In a typical machine, the voter's choices are entered into a temporary storage unit. The storage unit controls a display, visible only to the voter, of the choices made. With this feedback, the voter is given some reason to believe that the desired choices have been entered correctly into the temporary storage, but no independent proof can be provided to the voter that the choices have, in fact, been entered correctly for the purpose of summarizing those choices with all others to produce vote totals.
3.7.1 Summarization of DRE Machine Results
As a precinct-located machine, a DRE machine may have its results recorded on a removable data storage device or on a printout or both. The printout or device may be carried to a central station, or the data taken from the storage device may be transmitted over telephone lines. As with precinct-located ballot-tallying machines, there must be consideration of accuracy and security controls over such transmissions.
3.7.2 Vulnerabilities of DRE Machines
While the DRE machine is an electronic implementation of the lever machine concept, there is a significant distinction between them, other than their use of different technology. To prepare for each election, each lever machine is separately and individually set up (although several may be set up by the same technician).
Centralization of setup: Each DRE machine in an election receives its EPROM for set up from a single central source (the same as precinct-located ballot-tallying machines). In addition, the instructions on the face of the machine may be similarly produced centrally by computer. This centralization provides the opportunity for added efficiency and elimination of errors in the manual production of large numbers of ballot displays. However, there is the danger that centrally-created errors that are not discovered will be propagated throughout the system.
No audit trail of voters' choices: There is, also, a problem with DRE machines that is not present with ballot-tallying machines. This problem is the verification that the voter's choices have, in fact, been entered for summation precisely as the voter desired. The fact that the voter can see his or her choices on a display, or even receives a printout of the choices made, does not prove that those were the choices actually recorded in the machine to be summarized for generating the results of the election.
The assumption of correct recording of voter's choices must be bolstered with extensive pre-election and post-election review and testing of the logic of the machine, and further assurance that this logic cannot be fraudulently altered after the pre- election test. Furthermore, should this logic fail during the voting process, the logic must have been designed to fail in such a way that the failure is obvious to the voter. Otherwise, the voter will have no chance of ensuring that his or her votes are cast on a correctly operating machine.
Difficulty in operability verification: Pre-election and post-election testing of DRE machines is more difficult than ballot-tallying machines because, like lever machines, data input to a DRE machine is from a human. To statistically test the data-entry correctness of a ballot-tallying machine, a large number of ballots is needed, or a smaller number entered many times may be used. To statistically test the data-entry correctness of a DRE machine, either a person or persons have to vote many times, or a device must be built to simulate the action of a person.
When the voter indicates to the machine (e.g., by pushing a particular button) that the voting process has been completed, the contents of the temporary storage unit are added to the more permanent vote summary storage. Correct operation of the summarization process must be similarly assured.
Some assurance of the machine's correct operation of the summarization process may be achieved by the retention, in a more permanent form, of the set of each individual voter's choices that are determined by the machine. These voter-choice sets have to be retained in randomized locations so that no set of choices can be traced to a particular voter. If individual voter-choice sets are retained, they can serve as insurance against the occurrence of certain difficulties. These difficulties are that the contents of the temporary storage unit may be incorrectly added into the more permanent vote-summary storage, or that the vote-summary storage may be accidentally erased before it can be added to the final totals after the close of polls. The sets of voters' choices on a particular DRE machine may be summarized on an independent DRE machine or general-purpose computer for verification.
With DRE machines, no independently created ballots are available for verification of the correctness of both steps of the vote-tallying process, identified as steps (3) and (4) in section 3.1: precise recording of the expression of each voter's choices, and accurate summarization of all voters' choices to yield final results. Stored voter-choice sets may be used to verify only the latter of these two steps. The machine-produced recording of the expression of each voter's choices is not independent of the machine process that produced it. The machine cannot be used to independently verify its own correctness.
Precinct location: As DRE machines are precinct-located, there must be the same or greater concern for the vulnerabilities of that situation as those listed above for precinct-located ballot-tallying machines. These concerns include the risk of theft, tampering, fraudulent replacement of an EPROM, accidental interchange of EPROMs, and of defacement or alteration of the voting surface. Protection of the internal logic of the DRE machine must be of greater concern than with other types of machines, because of the lack of independently generated ballots.
3.8 Software For Computerized Vote-Tallying
Software that is intended for use in more than one election is usually written in a generalized form, and then is specialized for a specific election. The generalized software may be provided with a set of tables whose values are to be filled in during specialization.
This two-step process may be applied to any form of computerized system: punch card, mark-sense, or DRE. The specialization process establishes the number and names of offices and issues to be considered by the voters, the number of candidates and their names for each office, the number of allowable votes for multiple selection situations, and the implementation of special voting rules, such as for treatment of straight-party overvotes and for crossover voting. When the implementation for which the software is being provided includes precinct-located machines, the specialization process includes provision of the necessary parameters to complete the tables in the software of those machines. A device may be provided that can be used to copy the parameters of the election for each precinct from the main computer into the EPROM of the appropriate precinct-located machine.
Software written for general-purpose mainframe computers may be written in a high-level language such as COBOL. Mainframe computers are likely to be provided with extensive support software, such as compilers and programs for peripheral interfacing. The availability of such support makes the use of a language such as COBOL a reasonable decision. (However, see the discussion in 3.8.1 on "hidden code" in connection with general-purpose computers.) With the advent of single-purpose precinct-located machines having limited support software, much vote-tallying software now tends to be written in assembly language. Assembly language may have an additional advantage in providing the developer with more confidence that the real-time requirements of on-line ballot processing will be achieved by the object code. However, assembly language is considerably more difficult to review for logical correctness.
3.8.1 Vulnerabilities of Software
Vulnerabilities of software include logical errors, the possibility of "hidden code," and undocumented changes. No system type, punch card, mark-sense, or DRE, is immune from these threats. Protection against these threats requires implementation of effective management procedures that assure system integrity and security.
Logical errors: Several categories of logical errors need to be separately considered. First, a distinction may be made between generic logical errors that are independent of the conditions of elections, and election-related errors. Then, the latter may be subdivided into rule-implementation errors and setup-condition errors. Rule-implementation errors concern pre-established voting rules, such as for crossover voting and for straight-party overvotes. Setup-condition errors involve specific election matters, such as wrong rotations and incorrect assignments of candidates to districts.
Generic logical errors: These should be identified and eliminated during qualification testing, in preparation for State certification. Qualification may be done once, by a national testing laboratory, to satisfy the requirements of many States. Ideally, qualification should include a test of all possible features and functions and combinations of them. Resource constraints may limit testing to only some of the possible combinations of program features for a system. Qualification testing may involve review of logical flow charts and specific program code, as well as determination of system response to the normal flow of ballot data. Additionally, responses may be evaluated against the input of incorrect data, special cases, large volumes of data, and unplanned hardware failures while processing. Guidance in planning computer software acceptance testing is available [32], [33].
Rule-implementation errors: Qualification testing requires evaluation of the software as it will be implemented, so that elimination of rule-implementation errors should be a byproduct of this activity. A particularly difficult type of rule to implement is the required restriction in some States to one vote per candidate per voter in a vote-for-two situation when a candidate is listed on two party lines for the same office. Should a voter attempt to vote for the same candidate on both party lines in this situation, an incorrectly implemented DRE, punch card, or mark-sense system may assign the candidate two votes. An example of an occurrence of a rule-implementation error for straight-party overvote is given in section 4.4.2.
Setup-condition errors: Elimination of setup-condition errors is necessary as an activity in pre-election system checkout. In precinct-count systems, it is important to verify that the computer is implemented for the same rotation and other setup conditions as seen on the ballot for that precinct. In central-count systems, testing the system against a large number of ballots or ballot images may bring to light the presence of setup-condition errors. In any system in which there is ballot rotation, it is important to assure that the summarization of each candidate's votes is correct, considering the different ballot position of the candidate in the various precincts. See section 3.8.2 for additional automation that could alleviate the problem of setup-condition error.
"Hidden code": This term refers to a secret computer program inserted into another program provided to an unaware user. Software that contains such hidden code is often called "Trojan horse" software. Hidden code that has a function of copying itself into a user's program and being transferred elsewhere to repeat its intent is often referred to as a "computer virus." The purpose of the hidden code may be malicious, or it may be used to demonstrate the prowess of the perpetrator, or to surreptitiously record information for later retrieval.
Assuring the absence of any hidden code within a vote-tallying program is essential to system integrity; it should be a part of the qualification process. The task may be assisted with the use of a software engineering tool that identifies the use of each path in the program during program execution. If, in the exercise of a vote-tallying program, a particular path is not used (because the conditions that select it have not been employed), such a path may be further investigated to determine the selection conditions.
The problem of finding hidden code is complicated when vote-tallying software is mounted on a general-purpose computer. Hidden code may have been initially placed in a support program of the computer, for example the compiler or operating system. Such hidden code may be activated when the support program is called from the vote-tallying program. If a clock could be accessed by the hidden code, activation could be arranged to occur at a particular time on a particular day. The identification of the presence of such hidden code could be difficult and time-consuming, and a deliberate search, without specific evidence that the code exists, could be impractical.
Assuring system integrity with management controls: Realistic protection against the presence of hidden code in a general-purpose computer installation involves the application of management controls over the installation. An important control for protection against hidden code is the requirement that software be supplied only from an original manufacturer who is known, reliable, and can be held accountable. The copying of software from secondary sources should be forbidden.
Modifications to software must be strictly controlled to prevent unauthorized changes. Restrictions must be in place to control access to program codes that have been approved for operation. Authorized changes should be documented. Previous versions of revised software should be retained according to established procedures. Due to the threats from "hidden code," computer programs have been written that protect against it. The protective program is intended to run with an application, and to identify any modifications that are made. However, it is necessary that the application be initially free of any "hidden code" because only subsequent changes can be identified. In addition, the protective program might not be able to prevent unauthorized modification of computed data that is undertaken during operation from outside the program, for example, from the operating system.
An additional strategy to protect system integrity in vote-tallying is to have the vote-tallying software provided by its developer with all necessary support software, including the operating system, as a complete package. No other software would be necessary. In this way, the complete software for vote-tallying is separated from the influences of all other software. It is common practice for software for precinct-located machines to be provided in this condition. In the future, States may require the complete package of software (for any type of vote-tallying system) to be deposited with the chief elections official or an escrow agent, so that the provision of a complete package of software is responsive to this anticipated request.
The provision of a complete software package enables an additional protection to be applied: the data authentication code (DAC) [34]. This code value, a binary number, is computed by first randomly selecting a certain key value, and then applying that key and a specific mathematical function to the software package. The key value is kept secret. The computation of the DAC (which contains the same number of bits as the key) protects the software against both accidental and intentional, but unauthorized, data modification. To apply the function, the software package is treated as if it were a digitally-encoded message, as the DAC was developed to authenticate messages transmitted over communication lines. In application, the DAC would be generated for the original software deposited with the State, and would be generated also for the supposedly identical software used in an election. The two values of the DAC will be identical if the software packages are identical. (The software to be used in an election would have to be compared with the master copy before subsequent specialization for the election.)
There is a very small possibility that other software packages will have the same DAC value. If the software were altered, the probability of the DAC being the same for the altered software is extremely small. In fact, the probability is inversely proportional to the binary power of the number of bits in the DAC. That is, with an increase of one bit of length in the DAC, the probability of identicality is halved. Typical lengths of the DAC are from 32 to 64 bits. Furthermore, altered software could not be designed to have the same DAC value unless the persons performing the alteration knew the secret key used to create the DAC.
Assuring system security: Provision of all software as a complete package implies that the computer on which the software is to run can be dedicated to election operations. With the wide availability and downward cost trend of minicomputers and microcomputers, this possibility is reasonable, even for smaller election administrations.
The advantage of a dedicated computer is that access to the computer installation may be restricted by the election administration. Controlled access implies restrictions on electronic access to files through terminals or modems as well as restrictions on personnel entry to controlled areas. Sources of hardware, software, and supplies that are used may be controlled to assure accountability, as mentioned above. When the election administration simply serves as one of many users of a general-purpose installation, such restrictions enforced by the election administration are not generally available. The election administration may not be able to assure that the special concern for security necessary in election operations has the same or higher priority in the general-purpose installation.
3.8.2 Integration of Administrative Software
It is now possible to integrate vote-tallying software with other software that relates to the management of elections. Software can be provided that assists in the establishment of districts and precincts, and in the assignment of specific residence addresses to specific precincts. To be most effective, this software would need to be used in conjunction with computerized lists of all streets, street intersections, and established mailing addresses in the jurisdiction. The vote-tallying software would not need to be combined with the election management software, but would require the capability of being able to receive data from it, for example, through the use of shared storage.
Election management software can be used that helps establish ballot configurations and ballot rotations, and therefore can be used in connection with the production of ballots (for "datavote" and mark-sense systems), ballot pages (for "votomatic" systems), and ballot displays (for DRE systems). Such automation should assist in the reduction of setup-condition errors such as rotation errors and candidate mis-assignment errors. Setup-condition error is a major category of administrative error in election management.
In metropolitan counties with a ballot rotation requirement as well as with many overlapping minor jurisdictions, such as incorporated places, school districts, state legislative districts, and judicial districts, the number of different ballot styles in a consolidated election may be very large. Los Angeles county employs about 1800 styles, while other urban counties may use between 200 and 600. (Consolidated elections, involving Federal, state, and local offices simultaneously, have been mandated in many places to reduce costs and improve voter participation.) Computer programs can assist in reducing the need for multiple entry of the same data, and in sorting out the ballot requirements of each precinct and district.
3.9 Local Conduct Of Elections And Distribution Of System
Types
3.9.1 The Number of Major Election Jurisdictions
Each jurisdiction that conducts a major election (an election for Federal or State officials) must consider the acquisition and use of vote-tallying equipment. Thus, such a jurisdiction would need to consider the information provided above in this chapter. The ability of such a jurisdiction to bring resources to bear on the issues of acquisition and use of vote-tallying equipment may affect its capability to effectively carry out its responsibilities.
The discussion below identifies the jurisdictions that carry out major elections. The data show that there are a large number of small jurisdictions with election administration responsibilities. Application of resources available at the State level may be necessary to provide smaller jurisdictions with the capability to adequate deal with all of the issues of computerized vote-tallying.
In the United States, the responsibility for administration of elections is a State function (although the Federal Government may impose requirements, and has done so). Our only officials elected nationwide, the President and Vice-President, are indirectly elected by the selection of "electors" in each State. In each State, local governments actually conduct the elections for State and Federal offices, as well as for offices within their own jurisdictions. In 41 of the States, these major elections are carried out at the county level. (In four of these States, certain "independent" cities serve as county-equivalents and similarly carry out these elections.)
In nine States, major elections are carried out in units of government called minor civil divisions (MCDs) by the U.S. Bureau of the Census. An MCD is a first-order division of a county, and only States in the Northeast and Midwest have such units. An MCD may be a municipality (e.g., a city), or it may be another type of jurisdiction. The nine States in which MCDs conduct major elections are Michigan and Minnesota, in which the non-municipal unit is called a township, and the six New England States and Wisconsin, in which the unit is generally called a town (although other names, such as "plantation," "location," and "gore" identify a few units in Maine, New Hampshire, and Vermont).
Conduct of the election at the local level implies that, at that level, voter registration files are maintained, vote-tallying equipment is procured and maintained, voting locations are determined, precincts are staffed, votes are counted, and election results for the jurisdiction are produced. In November of each even-numbered year, when there are many Federal, state, and local officials elected, there are a very large number of mini-elections being administered simultaneously. Thus, the report that there were "Challenges in 4 States" [6] to a vote-counting program should be interpreted to mean that there were challenges to particular contests in elections in four local jurisdictions, one in each of the identified States.
There are about 3140 county-level units in the United States, including some 44 independent cities serving as county-equivalents. However, only about 2870 of them conduct elections for State and Federal offices in the 41 states in which counties and county-equivalents perform this function. There are about 7610 MCDs conducting elections in the nine states identified above. In addition, Washington (coextensive with the District of Columbia) and about 19 other cities (including New York and Chicago), not included above as county-equivalents or MCDs, conduct their own elections. Thus, there are some 10,500 local governments conducting major elections nationwide. Some of them are very large in population, e.g., Los Angeles County, and New York City, and some are quite small, e.g., Loving County, Texas, 1980 population 91. These 10,500 local governmental units essentially define the potential for use of vote-tallying equipment for major elections.
3.9.2 Distribution of System Types
The distribution of system types (for precinct use only, excluding use for absentee ballots) has been determined through a nationwide survey taken by Election Data Services, Inc. of Washington, DC [35]. The survey, based on data acquired in the first quarter of 1988, shows the following distribution, according to 1986 registration figures:
|
Type |
% Of Use By Registered
Voters |
%
Of Use By Counties |
|
Paper
Ballots |
6.9 |
32.6 |
|
Lever
Machine |
32.9 |
29.2 |
|
"Votomatic"
Punch Card |
35.9 |
22.4 |
|
"Datavote"
Punch Card |
4.3 |
2.3 |
|
Mark-Sense
Ballot |
7.5 |
5.6 |
|
Direct Recording
Electronic |
2.7 |
1.7 |
|
Mixed |
9.8 |
6.2 |
|
Total |
100.0 |
100.0 |
The "mixed" systems are in counties in which some areas use the "votomatic" punch card, others continue to use paper ballots, and a few use lever machines. The distribution of these systems by voter registration is approximately 45% "votomatic," 45% paper ballots, and 10% lever machines. With this additional data, the percent use of systems by registered voters is as follows:
|
Type |
% Of Use By Registered Voters |
|
Paper
Ballots |
11.3 |
|
Lever
Machines |
33.9 |
|
"Votomatic"
Punch Card |
40.3 |
|
"Datavote"
Punch Card |
4.3 |
|
Mark-Sense
Ballot |
7.5 |
|
Direct
Recording Electronic |
2.7 |
|
Total |
100.0 |
With some 45 percent of voters still not using computerized equipment (still using either paper ballots or lever machines), considerable opportunity for the implementation of new types of systems continues to exist. For example, it may be expected that in the near future registered voters' use of DRE machines will increase a percent or two, primarily as a result of the replacement of lever machines.
3.10 Future Vote-Tallying Systems
3.10.1 Technological Possibilities
With the increasing availability of data transmission over networks of computers and terminals, there is a possibility of on-line voting through the use of such networks. Even at present, precinct-located devices could be connected to central computers in an on-line mode. Whether this has some benefit greater than its costs is arguable, as results cannot be released before the polls close. Certainly, communications security must be a consideration.
Large single-application networks already in use that are user-oriented are networks for lotteries and for remote banking. Voting requires significantly more choices than a lottery or remote banking. In a lottery, the bettor selects just one or two numbers. In banking, the accountholder typically makes a binary choice of either withdrawal or deposit, selects an account type, and specifies a single amount. In voting, there may be Federal, State, and local offices on the ballot, plus several questions. The total number of contests requiring a voting decision may be twenty or more, and several contests may permit a selection of more than one candidate from a longer list of nominees.
In use of a network for voting, the traffic conditions would be extreme. The network would be used only about twice a year, but when in use, the volume of traffic would be very high. In a presidential election, over one-half the adults in the nation would be expected to use the network for about four minutes each over a twelve-hour period. In Los Angeles County, over 200,000 voting uses per hour in a presidential election would be required. Whether this could be both technically and economically feasible is problematic.
A possibility that may be more economical is the use of an existing network to which voting use is added when necessary, provided that the capability for the volume of use is present. The general telephone network might be utilized through voice response (to advise the voter of the choices) and push-button phones (for the voter to make choices), but again, volume is a strongly limiting factor. Cable television is another possibility, if it can be generally implemented in an interactive mode.
An important requirement in voting is the verification of registration. In remote-terminal banking, verification of accountholder status is typically accomplished at this time with a magnetic stripe credit-type card and a personal number. At point-of-sale terminals, it is common for sales personnel to obtain account status and to debit accounts to an on-line system with the aid of data on the magnetic stripe. (Lotteries have no personal identification requirement for use.) Whether it would be feasible to have such a system, like the one in use for remote banking, for a small number of uses per year by a very large number of persons is also problematic. Conceivably, social security number, driver's license number, or some other permanently assigned number could be used as an identifier. A card for voting might have other uses at public facilities, such as for library withdrawals or parking in public garages.
The process of remote personal identification is the subject of research. In the future, if a system with video bandwidth were available (e.g., interactive cable television), remote signature verification could be possible. At present, a precinct official can compare a prospective voter's signature with a computer-stored copy, but computer comparison without human intervention is not yet considered to be sufficiently accurate. With less bandwidth (e.g., the telephone network), voiceprint verification could be employed, but only if that process could be shown to be highly accurate. Again, this application is not considered to be technically feasible, in a general sense, in the immediate future. It is possible that a personally assigned "smart card," a credit-type card with an embedded computer chip, could be used interactively at a computer terminal to aid the process of remote identification.
3.10.2 Political and Social Priorities
The implementation of any system must be in accord with political and social priorities, as well as meet technical criteria of accuracy and reliability. For example, any installed system must meet several basic requirements: equal access by individuals to the voting franchise, verification of registration, the ability to cast a vote in secret without intimidation, and assurance of fairness to opposing parties. The advantage of establishing polling places (as opposed to voting from homes through cable television, for example) is that neutral locations where voting can occur without intimidation are set up. At neutral and public locations, representatives of opposing parties can be present and can watch the administration of the voting process. The establishment of technological access to the voting process that is available to some persons but not to others (because of acquisition costs borne by individuals) may not be consistent with the concept of equal access.
4. SOME RECENT DIFFICULTIES IN COMPUTERIZED
VOTE-TALLYING
The following are examples of difficulties that have occurred in the use of computerized vote-tallying, in the years 1980-1986. The purpose of providing these narratives is to demonstrate the types of difficulties that have been recently experienced. These reports provide support for recommendations concerning procedures that can be followed so that other election administrators may avoid similar difficulties. It is not the purpose of these reports to assess or assign responsibility or culpability for the difficulties experienced.
The examples were chosen for several reasons. Four of the situations (Carroll County, Maryland; Charleston, West Virginia; Elkhart County, Indiana; and Palm Beach County, Florida) had been identified in an article in the New York Times [6]. The situation in Dallas had been reported there in a separate article [36]. The remaining situations provide elucidation of particular types of problems and, in addition, reliable information about the situations was made available by authoritative or competent sources.
As in the 1975 vote-tallying report [1],in which examples of reported difficulties were given, the descriptions should be read with the following caution:
It is not intended that these descriptions be the definitive versions of what occurred. No absolute proof can be offered that the events occurred exactly as described. However, reported data have been supplied by named sources on the scene, and exact quotations by participants and observers are given when appropriate.
4.1 Carroll County, Maryland: November, 1984
Carroll is a county of about 100,000 population whose county seat, Westminster, is located about 30 miles northwest of the city of Baltimore. On November 8, two days after the Tuesday, November 6, 1984 general election, and in accordance with the rules of the Maryland State Administrative Board of Election Laws (SABEL), voted punch card ballots from two districts of Carroll County were taken to a neighboring county, Frederick, to be rerun on an independently-managed system. (Similarly, ballots from Frederick County were taken to Westminster to be rerun.) This rerun, in order to verify the original results, is necessary under Maryland regulations before the results may be certified.
It was clear from these reruns that one of the computers used was in error in determining the outcome of a contest between Wayne Cogswell and incumbent T. Edward Lippy, for Carroll County School Board. Manual counts of the votes on ballots from both Frederick and Carroll Counties showed that the Carroll County computer was the one that was incorrect. The initial but unofficial count, made public on the evening of the election, had incorrectly indicated that Cogswell was the winner.
An investigation, undertaken the next day (November 9) by Craig Jester, a county computer program contractor, demonstrated that a wrong utility computer program for reading the ballot cards had been used. After the correct utility program was installed, the results coincided with those obtained manually and with the Frederick County computer. The utility program, named COLBIN, had been previously written by Jester under contract to the county and had been successfully used in the May, 1984, primary election.
The purpose of the COLBIN utility program was to read the voted ballot cards in the "column binary" format used for voting, rather than in a simpler format. At the request of Carroll County data processing personnel and to reduce the price, Computer Election Systems, the vendor of the vote-tallying system, had supplied the system with an elementary utility program that could read cards only in the simpler format. With the simpler format, ballot cards would be required to have a maximum of one punch per column, not an acceptable situation for the Carroll County ballot. Carroll County contracted locally (with Pelorus, whose president was Craig Jester) for the COLBIN utility program.
On Saturday, November 10, the count was rerun (using the vote-tallying system including the COLBIN program). Members of the county Board of Elections and the County attorney were in attendance. The count indicated that Lippy was the winner. On Wednesday, November 14, eight days after the election, the Board of Elections certified the results, naming Lippy.
The cause of the error was reported in the Carroll Sun on Nov. 18, 1984 in an article by Steve Kelly [37]. A more complete explanation was provided in a letter, dated Nov. 26, 1984, from Thomas J. Van de Bussche, Administrator of the Data Processing Center of Carroll County, to Dr. Thomas Lewis, President of the Carroll County Election Board [38]. Mr. Van de Bussche's letter was included in a report submitted by Dr. Lewis on December 5, 1984 to Mrs. Marie Garber, Administrator of SABEL [39].
Mr. Van de Bussche admitted that, in testing an improved vote-tallying system provided by Computer Election Systems, he had inadvertently replaced the production version with a test version that did not include the COLBIN utility program. The logic and accuracy test of the vote-tallying system on Oct. 25, 1984, performed prior to the election in accordance with Maryland regulations, produced results consistent with the test ballots used. None of the test ballots had more than one punch in any column. Therefore, the test ballots did not reveal the error.
In the general election of November 6, 1984, the contest for the school board seat in question was listed in the same punch card columns as a home rule issue. The two contests were listed on different ballot pages of the "votomatic" ballot holder. The combination of votes for a school board candidate and a particular home rule position in the same column created a punch configuration that was not recognized as valid by the elementary utility program. As a result, some valid votes were not recorded in both the school board and home rule issue contests. Most of the votes not recorded (about 13,000) were for Lippy, because many Lippy voters chose the home rule position listed in the same card column. Votes not recorded on the home rule issue did not affect the ultimate outcome for that question. If the COLBIN utility program had been used, all votes on the contests would have been recognized as valid.
In summary, the incorrect announcement of the result of the school board contest on election night was due to mistakes by the Data Processing Center of Carroll County in using the wrong utility program and in using a perfunctory logic test that did not disclose the problem before the election. No factual evidence is available that contradicts the documentation submitted to Mrs. Garber by Dr. Lewis and Mr. Van de Bussche.
The incorrect announcement was not due to any error in the vote-tallying computer system supplied by the primary vendor, Computer Election Systems, nor any activity undertaken by its representatives. Nevertheless, on July 29, 1985, the New York Times, in referring to this particular situation, reported that "The vote counting program that has been challenged in .... Maryland was developed by Computer Election Systems of Berkeley, Calif." [6]
The error was discovered after the election but before certification because of a Maryland regulation that required recounting on an independently managed system. This specific regulation was based on a recommendation that "further confidence in the machine-counted results can be achieved if mandatory machine recounting of a percentage of the precincts for each race is carried out on a different, independently managed computing system than that used to produce the official count." [40]
On June 11, 1985, another recount of the school board race in question was carried out, using the Carroll County computer, again including the COLBIN program. This recount was undertaken at the request of the State court in which Mr. Cogswell, the defeated candidate, had filed a suit asking that the results of the election be re-examined. The recount verified the correctness of the election results certified on Nov. 14, 1984, although Mr. Van de Bussche has indicated that the recount results did not exactly match the count reported in the certification.
Mr. Van de Bussche has stated that the recount, carried out with all sides in attendance, was hurried and less than precise in that, with the permission of the court, card reader "checks" were ignored in the ballot-reading process. Usually, a card reader "check," indicative of a reading failure, would result in a decision to re-read the entire precinct of voted ballot cards. Instead, the card or cards causing the "check" remained unread and the reading process continued. The failure to re-read an entire precinct upon occurrence of a read "check" resulted in a small but random reduction of votes to both candidates, according to Mr. Van de Bussche. The differences were not significant enough to raise reasonable doubt as to the correctness of the certified results.
According to a July 11, 1985 story by Chris Guy in the Carroll County Times referring to the court-ordered recount, "...defeated candidate Wayne Cogswell had verification that use of an incorrect computer program caused a nearly 13,000-vote mistake in the unofficial totals released election night." [41]
4.2 Charleston, West Virginia: November, 1980
The following discussion was developed primarily from newspaper articles in the Charleston Daily Mail and Charleston Gazette.
Following the general election of November, 1980, three defeated candidates charged gross violations of election laws in Kanawha County, the county in which Charleston is located. Defeated U.S. Representative John Hutchinson first filed a complaint with the U.S. Department of Justice alleging that his civil rights had been violated. The other defeated candidates who joined Hutchinson in charging election law violations were former State Delegate Leonard Underwood and former Kanawha County Commissioner William Reese. Underwood, who was the first to initiate a suit, had filed for a recount after he was edged out in the election by Delegate John M. Wells. (Underwood was re-elected as a State Delegate in 1982.)
According to an article on June 2, 1981 in the Charleston Gazette [42], Darlene Kay Dotson, an employee in the office of the County Clerk, had stated in a deposition taken for Underwood's suit that the ballots from the election in question had been run through the computer on the day after the election to get "precinct-by-precinct reports." According to law, the ballots are to be secured for the official canvass, which was not done at that time. Two members of the County Commission, Robert Silverstein and Al Shepard, each possessed the only key to separate padlocks that were both needed to open the vault in which the ballots were kept, and both denied opening the vault or giving the keys to anyone else to do so.
According to the June 2, 1981 article, Carolyn Critchfield, also an employee of the office of the County Clerk, told Shepard that, to her knowledge, the ballots hadn't been out of the vault before the canvass. "Shepard said Mrs. Critchfield believed Ms. Dotson had events confused with the primary election when the ballots were run the day after the election," the article reported.
There was also concern about a test run of the computer's tabulation ability. Ms. Dotson had testified, according to the newspaper article, that neither County Clerk Margeret Miller, nor the county commissioners would sign the certification approving the test, and that she had to sign it.
Mr. Underwood had filed for a recount on December 2, 1980, and then, on December 16, he asked the circuit court to require that the election ballots be manually counted to compare them with the computer tabulation. In early February, 1981, a circuit judge denied Underwood's request, but on February 17, 1981, he filed an appeal with the state Supreme Court, asking for the manual count or a retabulation by the computer. However, following the circuit judge's denial of Underwood's request, the ballots had been destroyed by order of the County Clerk.
The state law in effect at that time stated that ballots shall be preserved for 60 days and "if there be no contest pending as to such election and their further preservation be not required by any order of a court, they shall be destroyed." According to Ray Dodson, lawyer for the County Commission, Mrs. Miller told him that she did not know that Mr. Underwood had filed an appeal in the state Supreme Court. Dodson said that there is some question as to whether Underwood's appeal constituted a true contest under the law.
On February 24, 1982, according to a February 25, 1982 article in the Charleston Daily Mail [43], County Clerk Margaret Miller was indicted by a special Kanawha County grand jury on six felony and nine misdemeanor charges. Three of the felony charges had to do with the removal of ballots from packages after the unofficial election night vote tally and before the County Commission's vote canvass that produces official totals. Two felony counts accused Mrs. Miller with allowing a vault containing the ballots to be opened between election night and the canvass. The other felony charge stated that she allowed the ballots from the general election to be destroyed while Underwood's suit was pending. In June, 1983, Mrs. Miller was found innocent of all charges. The jury had concluded that there was no "willful misconduct." [44]
However, in February, 1983, the three unsuccessful 1980 candidates filed a civil suit in Federal district court against Mrs. Miller and 15 other individuals. According to a newspaper article on February 5, 1983 [45], the suit alleged that the three were prevented from being elected because of a conspiracy on the part of the individuals named as defendants. In addition to Mrs. Miller, defendants included Mrs. Miller's husband Steven; former U.S. Representative Mick Staton, who defeated Hutchinson in 1980; Kanawha County Commissioners Henry Shores and Robert Silverstein; Kanawha County Prosecutor (and later mayor of Charleston) James Roark; several employees of the County Clerk's office including Darlene Dotson and Carolyn Critchfield; John Cavacini, Jr., a campaign worker in 1980 for Governor Jay Rockefeller; Computer Election Services, supplier of the electronic voting equipment used in 1980 in Kanawha County; several employees of that company; and Bernard H. Meadows, deputy clerk of the Boone County Commission.
Previous to the filing of the suit, former U.S. Representative John Hutchinson had been reported as charging that one of the defendants, John Cavacini, Jr. was in possession of final returns for the 1980 election two days after the Nov. 4, 1980 election and more than 30 days before the official canvass was completed on December 8, 1980. Hutchinson said, according to a June 5, 1982 article [46], that information in his possession
"...proves without any question, the machines didn't count at the canvass. I think the results were predetermined. It's conclusive in as much as the documentation shows after numerous absentee and challenged ballots were counted that the totals didn't change. The machine did not count the ballots."
Hutchinson also added that:
"There is a very great probability that the numbers were in the machine and the machine never counted anything."
In December, 1983, Hutchinson, Underwood, and Reese filed an amended lawsuit that specifically alleged that Kanawha County Clerk Margaret Miller and her staff rigged the vote-counting computers to predetermine the results, that ballots were mishandled, that some ballots were not opened until the canvass and then were counted to meet a predetermined result, that all ballots were not counted, that the vote canvass was falsified, and that the computing equipment was not properly tested prior to the election. The three plaintiffs also claimed that Boone County election officials tampered with the computer equipment before the election, that ballots were altered, and that an accurate ballot tally was not made. Irregularities in procuring the vote-counting equipment in both Kanawha and Boone Counties were also alleged [47].
In May, 1985, the suit was dismissed (charges against several defendants had been previously dropped), and the Charleston Daily Mail editorialized on May 3, 1985 as follows:
"[U.S. District Judge Charles] Haden sat through days of non-evidence on behalf of three plaintiffs -- former Congressman John Hutchinson, House of Delegates member Leonard Underwood and former county commission candidate William Reese -- all of whom lost election races in 1980 and have been mad about it now for more than four years.
"The plaintiffs were somehow allowed to bring this petty case to trial. Throughout, they failed to present a particle of proof to support their claims that 11 defendants conspired to deprive them of public office.
"People who run for election obviously like to win, but they must be prepared to lose. And barring solid evidence of fraud, they ought to accept their losses graciously without proceeding to harass either the individuals who ran against them or those who counted the votes." [48]
Appeals of the dismissal were similarly dismissed, and the U.S. Supreme Court announced on February 24, 1987 its refusal to hear the case.
Possibly influenced by Underwood's initial suit requesting a manual recount of the ballots, West Virginia amended its law on electronic voting systems in 1982. The revised subsection 3-4A-28 (4) is as follows:
During the canvass and any requested recount, at least five percent of the precincts shall be chosen at random and the ballot cards cast therein counted manually. The same random selection shall also be counted by the automatic tabulating equipment. If the variance between the random manual count and the automatic tabulating equipment count of the same random ballots is equal to or greater than one percent, then a manual recount of all ballot cards shall be required. In the course of any recount, if a candidate for an office shall so demand, or if the board of canvassers shall so elect to recount the votes cast for an office, the votes cast for that office in any precinct shall be recounted by manual count.
4.3 Dallas, Texas: April, 1985
In the election for Mayor of Dallas, held April 6, 1985, the incumbent Starke Taylor avoided a runoff by obtaining slightly more than the required 50% of the vote. There were three opponents to Taylor: Morehead, Goldblatt, and Daniel. Max Goldblatt, the leading opponent, requested a recount. A machine recount (including absentee ballots that were mixed in) was undertaken on April 11, 1985, by order of the District Court. The original results and the recount results are summarized below: [49]
|
|
Morehead |
Taylor |
Goldblatt |
Daniel |
Write-In |
|
Original |
2,318 |
38,998 |
35,081 |
621 |
10 |
|
Recount |
2,318 |
38,973 |
35,082 |
619 |
10 |
The machine recount showed that, overall, Taylor's votes decreased by 25, while Goldblatt's votes increased by just one, an insufficient change to cause a runoff election. Mr. Goldblatt did not raise a challenge to the accuracy of the recount at that time, and Mr. Taylor was confirmed as Mayor for the two-year term.
Taken as a whole, the recount results would appear to confirm the vote totals produced in the original count, but a precinct-by-precinct review [50] raises technical questions about the accuracy of the combined human and computer system that produced them. There were 250 precincts in this election, but only 89 precincts showed no change in votes for any of the four candidates in the contest for mayor. Taylor's votes changed in 100 of the 250 precincts, while Goldblatt's votes changed in 113 precincts.
In the recount, Taylor lost one vote in 45 precincts, two votes in each of ten precincts, three votes in each of four precincts, and five votes in each of two precincts. Taylor gained one vote in 25 precincts, two votes in each of nine precincts, three votes in each of three precincts, and five votes in each of two precincts. These changes sum to a loss of 25 votes.
Goldblatt lost one vote in 47 precincts, two votes in each of five precincts, three votes in each of two precincts, four votes in each of two precincts, and five votes in each of two precincts. Goldblatt gained one vote in 41 precincts, two votes in each of ten precincts, three votes in each of three precincts, and twelve votes in one precinct. These changes result in an overall gain of one vote.
In addition, the number of ballots counted changed in 109 of the 250 precincts, for a total loss of 27 ballots [51]. Fewer ballots were tallied in 59 precincts, while more ballots were tallied in 50 precincts. In precincts that lost ballots, one fewer was counted in 37 precincts, two fewer in each of eleven precincts, three fewer in each of seven precincts, four fewer in each of two precincts, five fewer in one precinct, and seven fewer in one precinct. In precincts that gained ballots counted, one more was counted in 33 precincts, two more in each of 13 precincts, three more in each of two precincts, and four more in each of two precincts.
For the recount, data on changes in precinct vote totals for the candidates were made available to the public. However, the number of ballots counted in the recount in each precinct was not included in the data released. The changes in ballots counted that are presented above are based on data collected by Ms. Terry Elkins, campaign manager for Max Goldblatt. Ms. Elkins was present at the recount, and copied down the number of ballots tallied for each precinct.
The causes of the changes in ballots and votes counted are not clear. However, changes occurred in such a manner as to yield both positive and negative values in approximately equal amounts, and the number of precincts in which changes occurred tended to decrease as the value of the change became more severe. This situation suggests a problem of system inaccuracy, rather than of deliberate bias. This inaccuracy could be of either human or mechanical origin, or both.
When numbers of votes change in a system using pre-scored punch cards, the problem is often ascribed to hanging chad, although failure of the card readers to read the cards accurately is a reasonable possibility. If the problem is said to be due to chad, the explanation is that a hanging chad may fall out, creating either a vote or an overvote; or, a hanging chad may be pressed back into place, usually eliminating a vote.
The cause of changes in ballots counted is more perplexing. In the system used in Dallas, ballots were hand-fed into the card readers one at a time, by both the voters and the recounters. Consequently, it is unlikely that, on several occasions, two cards were fed at one time and counted as one. However, the system used at the precincts by voters required each voter to handle his or her ballot twice. First, the voter fed the ballot into the precinct ballot computer. Assuming that the computer accepted the ballot, the voter was then supposed to retrieve the ballot from the output of the computer and drop it into a ballot box. In some cases, a voter may have put the ballot into the ballot box without first having fed the ballot through the computer, or conversely, the voter may have fed the ballot through the computer more than once. On the other hand, inaccurate card counting by the machines, due to card jams, is a possibility. Only a thorough audit of voter sign-in lists, compared with an accurate count of numbers of ballot cards delivered from the precincts to the election headquarters could provide a more confident basis for a statement of the cause of the identified ballot count discrepancies.
In September, 1986, Ms. Elkins concerns about the election were publicized. These concerns included matters other than the differences between the original count and the recount, as discussed above. Instead, a major aspect of the information provided by Ms. Elkins at that time concerned the total number of ballots cast for Mayor. She noted that the "Combined Canvass Report" produced by the Dallas County Election Department on the evening of April 6 stated on page 14 that there were 78,398 ballots cast, while the same document stated on page 27 that there were 80,208 ballots cast. Furthermore, the "Official Cumulative Report" (which serves as an overvote-undervote report), produced by the Election Administration on April 8, stated that there were 79,783 ballots cast. Ms. Elkins contended that documentation that she had gathered supported none of these numbers of total ballots cast.
Ms. Elkins also noted another apparent discrepancy in the results reported for a City Council seat. In that situation (District 7), the number of votes tallied was reported to be 10,365. This value exceeded the number of ballots reported to be cast, 9,679. In addition, in one precinct, the initial number of ballots cast, 263, was replaced later with another value, 515. These technical concerns of Ms. Elkins were supplemented by concerns that the results presented on the computer printouts were created independently of the actual totals of the voted ballots through a deliberate attempt to subvert the outcome. [52]
As a result of Ms. Elkins' complaints, it was reported that Attorney General Jim Mattox and Secretary of State Myra McDaniel began investigations into voting discrepancies. According to the Dallas Morning News of Sept. 23, 1986, "the probe centers on allegations that computerized voting equipment and computer programs used to tabulate state and local elections may have been tampered with to bring about `preprogrammed' results." [53]
In that same newspaper article, Ms. Elkins was quoted as saying that "the allegation is that the computer used to count the votes was given new instructions after it calculated that Max Goldblatt was leading Starke Taylor by 400 votes." Ms. Elkins has noted that the Dallas County computer had encountered difficulties shortly after 8 p.m. on election night, and that the candidate who was leading at 8 p.m., prior to the computer difficulties, was not leading when the computer reported again.
Ms. Conny McCormack, Dallas County Elections Administrator, admitted that the documentation for the April 6, 1985 election could appear contradictory. Her explanation was that the difficulty concerned the treatment of "split precincts," that is, those precincts bisected by the Dallas city boundary. There were 11 such split precincts. The value of 78,398 for ballots cast was produced by assuming zero ballots cast from these split precincts. The value of 80,208 for ballots cast was produced by adding the total ballots from the split precincts, including ballots cast outside of the city. The final value of 79,783 for ballots cast included only those ballots cast within the city of Dallas. Ms. McCormack contended that the recount generally confirmed the correctness of the originally reported outcome. [54]
Ms. McCormack's explanation of the problem of reporting split precincts was supported by the vendor of the vote-tallying system. In a memorandum on the subject, a vendor representative stated that there was a difference between the type of reports requested by Dallas County Elections Department for the PBCs (precinct ballot counters) and for the central computer. The central computer was used to accumulate totals reported by the PBCs. The coding for the central computer included provision for split precinct specification of ballots cast, but the coding for the PBCs did not allow for this. According to the vendor, "this extra statistical option was not requested by Dallas for that election." [55]
The vendor representative further stated, in the same memo, that:
"Since the [data] packs did not have this [split precinct] information to transmit, all of the precincts which were transmitted had a "zero ballots cast" for the districts. Again, total ballots cast and all candidate votes were present and correct.
"On the cumulative report, then, the votes received by the district candidates were much greater than the ballots cast figures for those districts. Although the explanation for this apparent anomaly is now clear, it clearly was a suspicious looking situation."
With regard to the change in ballot totals reported for one precinct, Ms. McCormack stated that this was due to a failure of a PBC data pack. This occurs about 2% to 4% of the time, she stated. The procedure when this happens is as follows:
"When [a failure of a PBC data pack] occurs, the actual ballot cards are counted at the central counting station. Such discrepancies from PBC tape to actual ballots cast is determined by examination of the specific Ballot and Seal Certificates. When there is a discrepancy between number of persons signing the signature roster at the precinct and the number of ballots cast according to the PBC tape, then the ballots from that precinct are counted centrally." [54]
A summary of the ballots cast in this election, as officially reported, is shown below, by district. It can be seen from the table that the largest component of ballots from split precincts occurs in District 7, where the increase from Column A to Column B is 1,661. However, 422 of these ballots were from outside the city, so that the total number of ballots cast in District 7 inside the city is 10,918. The latter number is shown in Column C, and it is appropriately higher than the total votes for candidates in District 7, which was 10,365. [56]
|
District |
(A) Excluding Split Precincts |
(B) Including
All Ballots
From Split
Precincts |
(C) Only
Ballots Cast
in City |
|
1 |
9371 |
9395 |
9392 |
|
2 |
6314 |
6314 |
6314 |
|
3 |
16351 |
16382 |
16382 |
|
4 |
14529 |
14529 |
14529 |
|
5 |
13088 |
13088 |
13088 |
|
6 |
4118 |
4118 |
4118 |
|
7 |
9679 |
11340 |
10918 |
|
8 |
4948 |
5042 |
5042 |
|
Total |
78398 |
80208 |
79783 |
Certain technical problems raised by Ms. Elkins seem to have been given a credible explanation, on the basis of information made publicly available in late 1986. However, as Warner Croft stated in his testimony to the Texas House of Representatives Committee on Elections:
"There is an audit trail but there are holes in it. The audit trail should consist of everything from the ballots themselves to the console log being printed by the computer on election night. The present laws don't identify what the minimum requirements are, so that, with the absence of a minimum definition, it just does not exist. You go after these things, and the laws don't require that they be kept on file now, so they have been destroyed months ago. So you really couldn't tell if there was fact to these allegations are not. That has been one of our problems. Records aren't available; there are no auditable results." [22]
Ms. Elkins' charges that the results were "preprogrammed" independently of the actual votes cast were not put to rest in 1986. In March, 1987, the Texas Attorney-General's office asked the District Attorney of Dallas County to assist in reviewing the election complaints. The review concerned "the reliability of Dallas County's computerized election system and whether the equipment is vulnerable to fraud through subtle changes in computer programs." [57]
On October 14, 1987, the office of the District Attorney of Dallas County replied to the Texas Attorney General's Office with a letter [58] including the following:
"We have carefully considered each of the thirteen (13) "discrepancies" discussed in the report [submitted by your office], and ... each of the "discrepancies" has been explained to our satisfaction; and although we verified that a few coding errors were in fact made, we have concluded that they were the result of unintentional "human error." We find no evidence whatsoever to indicate any deliberate fraud in the 1985 election, nor do we find any credible evidence to indicate an attempt to manipulate the election or its outcome by anyone, be it candidate, election official, or vendor."
Some knowledgeable persons have found this statement puzzling, in view of Warner Croft's testimony that necessary documents constituting the audit trail had been previously destroyed.
In the April, 1987, mayoralty election, split precincts were eliminated by the Dallas County Election Administration. Precincts that had been bisected by the Dallas city boundary or City Council district boundary were divided into two or more separate precincts. Letters A and B, added to the precinct identifier, were used to distinguish the formerly combined precincts, as in 1193A and 1193B.
4.4 Elkhart County, Indiana: November, 1982 And November,
1986
4.4.1 November, 1982 General Election
Elkhart is a county of about 140,000 population on the northern border of Indiana, located about 90 miles east of Chicago. In lawsuits filed in state and Federal courts, several losing candidates alleged that election fraud occurred in the administration of the general election of November 2, 1982.
In this election, the computer facilities of a bank located in the county seat of Goshen were used for ballot-counting purposes. The office of the county clerk had limited computer expertise for carrying out its responsibilities for management of the ballot- counting process. Technical operations related to computer processing of the ballots were undertaken by bank employees and by an employee of the vendor of the vote-counting software. The bank's computer was capable of multiprogramming, and bank operations continued during ballot counting.
It is important to note at this point that punch card ballots in a general election in Indiana have "straight party" punch locations. A voter who votes one (and only one) of these punch locations automatically votes for all candidates of that party unless the voter specifically votes for a candidate of another party in a particular contest. A vote in a particular contest always overrides the straight party vote. This feature of Indiana ballots figures prominently in this situation.
Procedural and computer-related errors in the election affected at least three contests. The errors concerned votes for the Town Board of Wakarusa (a town within Elkhart County), votes for Districts 2 and 3 of the County Council, and votes for a State Representative contest.
The boundaries of the town of Wakarusa are wholly within Olive Township of Elkhart County. Some of the voters in this township live within Wakarusa, and some live outside the town. Only those residing within Wakarusa are entitled to vote for the Town Board. However, no arrangements were made to distinguish town residents from non-residents for purposes of casting ballots. All voters in the township were given the same ballot. The result of not separating ballots of residents and non-residents was that Town Board candidates received more votes than they were entitled to obtain. The extra votes were from voters residing outside the town, and these consisted primarily of straight party votes that were assigned by the vote-tallying computer program to Town Board candidates as well as to other candidates on the ballot. In addition, there may have been votes for individual Town Board candidates by non-resident voters who mistakenly voted for them.
The Wakarusa problem was not discovered until several days after the results were certified, when an election worker realized that the total number of votes for Town Board candidates was much higher than that number of votes which could have been cast by voters entitled to vote for Town Board. The problem was "solved" by an informal agreement approved by the Election Board under which all straight party votes were eliminated for Town Board candidates. This "solution" disenfranchised those voters within the town who lawfully cast straight party votes. The change overturned one outcome, but the loser was dissuaded from suing. According to Elkhart attorney David T. Stutsman, the agreement to change the outcome was in violation of Indiana law, and a legally correct solution would have been to hold a new Town Board election.
In the counting of votes for County Council, votes for candidates in Districts 2 and 3 were interchanged. This situation became apparent to one of the Election Board members when Higgins, the unopposed candidate in District 3, was initially shown to have a significant number of opposing votes. In addition, Barnes, the incumbent in District 2, was getting almost no votes, while Wiedenhoeft, Barnes' novice opponent, was winning a large majority. This unexpected condition was pointed out, and the interchange was discovered. The error was corrected by changes in control cards that were carried out by an employee of the software vendor. This latter individual had been sent from another state by the software vendor for the sole purpose of assisting in ballot-counting operations. He appeared for the first time on the afternoon of the election, and returned to his home state immediately following the completion of the computerized vote-tallying.
In the contest for State Representative, it become apparent late in the evening of November 2 that an incorrect punch position was being used to tally votes for one of the candidates, Philip T. Warner, in his race against Mike Puro. The software vendor's employee again changed some control cards, and a retabulation was undertaken. The retabulation resulted in a significant change in vote totals: an increase of 3,710 for Warner and a decrease of 53 votes for Puro. The reason that there was a decrease in Puro's totals was because of individual votes for Warner by voters who had also indicated a straight party punch for Puro's party. Before Warner's votes were properly tabulated, the straight party punches had added to Puro's total, but the specific votes for Warner on the same ballots negated these straight party votes.
It seems clear, from the Wakarusa situation, that the full implications of computer processing of ballots were not completely appreciated by the persons responsible for running the election: the Election Board and its employees. In addition, it seems clear, also, from the tabulating errors in the County Council and State Representative contests, that insufficient attention was paid by those responsible for running the election to examination of the "edit list" that identifies, for the computer, the assignment of punch locations to candidates. Adequate testing of the computer system prior to use appeared to be lacking, possibly to an extent inconsistent with Indiana law.
The alleged misfeasances have been described in lawsuit briefs filed by the losing candidates, and documentation on the charges has been obtained from David T. Stutsman, their attorney. A major source of problems in the election was the apparent failure to properly test the equipment prior to use. The losing candidates charged that no test of the automatic tabulating equipment was undertaken five days prior to the election, as required by the Indiana statute then in effect, and that only a superficial test was done at about 4 p.m. on election day.
According to Mr. Stutsman, this test on election day consisted of a count of just 13 test ballots each for only two precincts of the 63 precincts involved in the election. As a result of a lawsuit concerning this election, an alleged configuration of these 13 cards and the results that they generated on the computer have now come to light. According to this information, the test ballots should have generated three lawful votes for the Democratic senate candidate, but instead they generated four such votes. One test ballot that should not have produced a vote contained a straight Democratic punch, and individual punches for both Democratic and Republican senate candidates. A second test ballot that should not have produced a vote contained straight party punches for both the Democratic and Republican parties, that is, an uncountable straight party overvote. One of these test ballots probably supplied the incorrect fourth test vote. If this information about the test ballots and results is correct, the ballot counting process on November 2, 1982 should not have proceeded until the logical error was corrected. As stated in the Indiana statute I.C. 3-2-4-4(f) in force at the time:
"If any error is detected [in the test], the cause therefor shall be ascertained and corrected and an errorless count shall be made before the automatic tabulating equipment is approved."
Other errors in administration that have been alleged were that the changes in the control cards that were made were not accompanied by system tests, that the computer systems's clock was disabled (thereby preventing times of console actions from being reported), and that no precinct numbers were printed on the ballot cards.
Computer consultants hired by the losing candidates submitted statements including the following:
"The Edit List was not correct when the program was initiated.... Thorough tests would have caught these irregularities.
"Given the nature of the undocumented program correction ... it is impossible to know exactly how the program tallied the votes. The control log shows no test of accuracy after the [vendor's] representative modified the parameter cards.
"The lack of a clear audit trail and the lack of error reports, the convoluted code reports plagued with errors, and the unquestioned trust in an untested electronic process seems to be a major problem with this system comprised of hardware, software, and users.
"In the opinion of [the computer consultants,] it would be possible to modify program logic with the use of inserted control cards. It would be possible to change accumulated vote totals by reading in control cards at the appropriate time during the program execution. This would be unknown to the election officials or anyone but an experienced operator. This program uses alter verbs which allows program logic changes with the use of control cards inserted at execution time.
"A knowledgeable operator can change the program logic in execution with insertion of control cards ... many possibilities for change in program logic and vote tally exists." [59]
The losing candidates' case, brought before the U.S. District Court for the Northern District of Indiana, named the local board officials as defendants. It was alleged in the pleadings in that case that the computer system was not tested, that there was no error-free test of the system before the official count, that there was no actual count of the ballots and that the alleged count and certification of the vote count was fraudulent. The pleadings and briefs further stated that the control cards for the operation of the program were altered by the vendor representative during the counting, and that the acts by the election officials were willful, wanton, reckless and oppressive.
However, the court entered a summary judgment on Feb. 21, 1985 against the losing candidates because, in the court's opinion, there were no allegations of any "willful conduct which undermines the organic processes by which candidates are elected" (language of an important precedent, Hennings v. Grafton) [60]. The judgment of the lower court was affirmed by the U.S. Court of Appeals for the Seventh Circuit, which stated that "the appellants (i.e., the losing candidates) confuse fraud with what is at most willful neglect." [61] Mr. Stutsman notes that the plaintiffs were not allowed to present their evidence in the case. The lawsuit was dismissed as a matter of law, without a trial on the merits. Therefore, a jury was not allowed to hear the case.
A second Federal lawsuit, filed in the Southern District of Indiana, continues to be pending, with the vendor named by the New York Times as the principal defendant. This suit charges negligence, breach of contract, and strict liability, alleging that the computer system used in the election was sold in a defective condition and caused loss and damage to the losing candidates. In addition, it is alleged that the vote counting was a fraud and that the certification of the vote totals was false and fraudulent.
4.4.2 November, 1986 General Election
Following the 1986 general election, a State-mandated recount was undertaken that included ballots from Elkhart County. In this recount, directed by Dean David Link of the Notre Dame Law School, it was discovered that the computer program used to count ballots in Elkhart County was not counting correctly according to Indiana law. The problem occurred in the treatment of ballots that were overvoted in the "straight party" positions. According to Indiana law, these ballots should be voided for all partisan contests. Instead, the ballots had been counted in the contest being recounted. These ballots were eliminated in the recount.
4.5 Gwinnett County, Georgia: November, 1986
A recount undertaken in a State Senate race showed the loser in the first count winning the contest by 77 votes. The original tally had given challenger Steve Pate a winning margin of eight votes. However, the recount gave incumbent Donn Peevy 13,682 to Pate's 13,605. According to an article in the Atlanta Constitution, November 13, 1986, "the recount was the result of a computer hardware error ... affecting hundreds of uncounted votes ..." [62] The "computer hardware error" in question was believed to be a problem with the card readers that read the pre-scored punch card ballots.
Allegations raised in this election included charges of "hidden ballots." It appears that a box of ballots and documents received from one precinct was initially believed to consist of the complete set of voted ballots on top of other documents in the box. When the documents were removed from the box after the ballots on top had been counted, more ballots were found under the documents. In addition, it was "charged that ballots from two precincts did not arrive at the elections office until early on the morning of Nov. 5 [the day after the election] in the car of the elections board member," according to the article in the Constitution.
The original count was undertaken on a system consisting of two personal computers, each with a card reader, networked together to drive one printer. For the recount, it was agreed to separate the two computers and to count the ballots twice, once on each computer. Unfortunately, the recounts obtained from the two computers were slightly different, although not of a difference sufficiently large to overturn any contest.
The Georgia Tech Research Institute (GTRI) was asked by the office of the Secretary of State of Georgia to render any possible assistance. GTRI decided to review the situation and to determine the source the discrepancies between the two computer outputs. The investigatory team, headed by Dr. Britain Williams, hoped to separate the causes of the errors into at least two classes: those caused by handling of the ballots by voters and voting officials, and those caused by the hardware. According to Williams, "everything that could have been done to insure the accuracy of the recount was, in fact, done and the discrepancies observed are inherent in this type of system. A thorough analysis of these results will be conducted in an attempt to estimate the inherent error in using pre-scored ballots." [63]
A report has now been produced by Williams and an associate. [106] The report compares differences in the results in three counts: the general election, and the recounts on the two individual machines. The report states that:
"Errors were either tabs which were not yet dislocated from their pre-punched positions in the ballot, or stray tabs which filled other previously punched-out positions (+ and - errors)."
According to the report, errors were caused by such factors as handling procedures, the ballot puncher (which was of the "votomatic" type), the vote counter, the punched card's density, vote position on the ballot card, human error, and pure chance. The report concludes that:
"...there should be a system set up to make the voters and especially the volunteer workers aware of the effects procedural care has on the accuracy of tabulations (since this was where the main problem was discovered). Details like not putting large (or any) rubber-bands around the ballots would also be advisable (especially since custom ballot carriers are provided)."
4.6 Illinois - Statewide Testing Program
The Illinois State Board of Elections, Division of Voting Systems, under the direction of Michael L. Harty, (now Director of Elections, Maricopa County, Arizona) has undertaken tests of vote-counting computer systems. Between 1983 and 1987, the division conducted 48 tests of the automatic tabulating equipment and computer programs in 41 election jurisdictions. The tests have involved anywhere from 1,000 to 65,000 test ballots. The division found apparent computer program tabulation errors in 11 of the election jurisdictions tested. The division reports that most of these errors would not have been discovered without adequate testing. As a result of its testing experiences, the Division of Voting Systems has concluded in its Summary of Findings and Observations on State Board of Elections Computer Testing Program, revised February, 1987: [64]
"The testing of computer vote tabulation systems needs to be improved substantially. At a minimum, voting systems tests must be large; must test all voting positions; must test overvotes and undervotes; column binary punches; straight and split party votes; nonvoting position punches; and must test for every candidate in every ballot configuration in every precinct. Only by extensive testing of a computer vote tabulation system can we be reasonably assured that tabulation of the ballots will be entirely accurate".
The following descriptions of programming, program initialization, and hardware problems in local jurisdictions in Illinois are taken from the reference given above.
4.6.1 Programming and/or Program Initialization Errors
Whiteside County - 1986 General Primary Election: The system tabulated votes on ballots that contained invalid security codes (ballot style identifiers).
Morgan County - 1985 Consolidated Election: No straight party votes registered for the candidates of a party. However, this did not affect the individual candidate totals.
Peoria County - 1985 Consolidated Election: The computer program misassigned straight party punches for a candidate for township supervisor. The candidate received a tally from a straight party punch for the opposite party but failed to receive a tally from the straight party punch of his own party.
Sangamon County - 1985 Consolidated Election: The computer program would not accept ballots with proper ballot style identifiers. This error was not discovered by the test previously run by the local jurisdiction. In addition, ballots in precincts with more than one ballot style did not contain different style identifiers. Thus, it would not have been possible to separate the voted ballots of the different styles.
Logan County - 1985 Consolidated Primary Election: Tabulation errors occurred when precincts were split by ward boundaries. When the same punch position was assigned to different candidates in different wards in the same precinct, votes for one of the candidates were not tallied by the computer program.
Effingham County - 1984 General Election: A county-level office was not being tabulated in five precincts, though votes were assigned to the office.
Jackson County - 1984 General Election: A translation error between precinct returns and the summary report caused the summary report to fail to properly reflect the precinct sum totals for certain candidates.
LaSalle County - 1984 General Election: The straight party vote was not being tabulated for all candidates in a party. In addition, when an overvote occurred in the straight party column and also in an individual candidate's punches on the same ballot, the candidates involved actually lost a vote, i.e., had their vote totals reduced by a vote (instead of simply being denied a vote).
Grundy County - 1984 General Primary Election: Forty-seven percent of the precincts had one or more of the following types of errors: (1) the assignment of the wrong county board districts in the precincts, (2) the deletion of candidates in precincts, (3) the incorrect assignment of candidates to precincts, (4) assignment of only 2 vote for each vote cast, and (5) incorrect totals of precinct votes on the summary report for several candidates.
Rock Island County - 1984 General Primary Election: Two votes for each vote cast were being tabulated for a candidate. In addition, the "no" votes on a proposition were not being counted. Further, the summary report totals did not properly reflect precinct sum totals for several candidates.
4.6.2 Hardware and Punch Card Difficulties
City of Chicago - 1987 Consolidated General Election: The system test indicated an approximate 3% failure rate of program chips. The chips were improperly programmed or "burned." The malfunction would have been identified during the public test.
Boone County - 1987 Consolidated Primary Election: Due to substantial ballot quality defects, a system test could not be executed. New test ballots were ordered.
Pulaski County - 1986 General Primary Election: The principal disk that contained the vote-tallying program failed to operate for the system test. The duplicate (backup) disk was employed. The principal disk operated correctly for the public test. No reason for the problem was discovered.
Jackson County - 1984 General Election: Column binary punching appeared to cause severe tabulation delay. In addition, the card reader stopped occasionally during the tabulation of a precinct. When this condition occurred, the results already obtained had to be erased and all the ballots for the precinct had to be retabulated. The cause of this difficulty could not be immediately ascertained.
Will County - 1984 General Election: During the system test, the card reader was jammed twice by ballots. The ballots involved were almost completely destroyed in the process.
4.7 Maricopa County, Arizona: September, 1986
A clerical error that would have interchanged votes for the two major parties in this primary election was caught during testing. Pre-punches (ballot style identifiers) were incorrectly specified, and if the errors had not been caught, votes in the primary contests in each party would have been assigned to the other party during tallying. Poor communication between the county data processing department and the election administration contributed to the problem. A well-designed testing process caught the error, so that ballot counting during the actual election was not affected. [65]
4.8 Moline, Illinois: 1985 Consolidated Municipal and Township
Election
The following report is primarily based on an article in Illinois Issues, November, 1985, that was republished in a newsletter of the National Center for Policy Alternatives. [66]
In this election on April 2, 1985, the failure of a card reader to read correctly caused a losing aldermanic candidate for Moline City Council to be put into office. The error was not rectified until about three months later.
The failure of the card reader was not initially apparent. It was only discovered after defeated Moline 3rd Ward aldermanic candidate Earl Wendt went to court to demand a recount. Wendt had lost by two votes, and the recount was ordered by Rock Island County Circuit Court. In the recount on May 14, Wendt picked up two votes, but his opponent Allen McCauley picked up 92 votes. The large change in McCauley's total demonstrated that a serious error in vote-tallying had occurred. The data showed that the error was in the failure of the system to tabulate many straight party votes for McCauley. Further investigation appeared to demonstrate that the problem was a slipping timing belt in one card reader.
As a result of the Wendt-McCauley recount, the party of losing 4th Ward aldermanic candidate Charles Reynolds also demanded a recount in a petition to the Moline City Council. Reynolds was of the same party as McCauley. However, the City Council denied this petition and two similar petitions from other candidates on the basis that the 30 days following the election allowed for such petitions had expired.
Following these denials, Dennis Faust, assistant State's Attorney submitted a petition of quo warranto to Chief Judge David DeDoncker of the 14th Judicial Circuit. The quo warranto petition, whose origin in Anglo-American law goes back to Edward I in 1275, is used to remove "any person [who] shall usurp, intrude into, or unlawfully hold or execute any office...", according to the Illinois Revised Statutes. Faust's theory was that if members of the Moline City Council hadn't received a majority of the votes, then they held office illegally.
On July 8, Judge DeDoncker agreed to a recount for the office of city clerk and for three aldermanic offices including that for the 4th Ward, despite the fact that the 30-day period had expired. He stated that there was no knowledge that a machine was not working until 40 or 50 days after the election. "We had legal American voters who voted and did not get their votes counted", DeDoncker said. The judge appointed representatives of the vendor of the vote-counting system to serve as officers of the court and ordered them to conduct a recount. A judge of a higher court refused to stay the recount, and it proceeded.
As a result of this recount, alderman Roy Lear picked up two votes, but his opponent Charles Reynolds added 135, making the final count 557 for Reynolds to 473 for Lear. Through a court order, Lear was removed from the city council. Reynolds was seated in his place. Lear did not appeal.
4.9 Oklahoma County, Oklahoma: November, 1986
In the general election of November, 1986, difficulties perceived by an independent group of local observers involved, among other items, the operability of the precinct-located, mark-sense computers, and the anomalous numbers of counted ballots that were reported. These observers, David Clampitt, Carolyn Burkes, and Sue Milton, submitted the data on which the discussion below is based.
The county signed a contract to purchase the mark-sense vote-counting equipment in the summer of 1984. The State of Oklahoma has no system of prior State approval of voting devices before such devices may be purchased by a county. However, no county may purchase a type of voting device before the State Board of Elections has implemented rules of operation for that type of device. Four counties in the State utilize mark-sense type voting devices. Oklahoma County is the only county of these four utilizing the particular model in question.
Engineering tests on the particular devices purchased by Oklahoma County were not carried out by the county until November and December, 1984, when the equipment was being delivered. A feature of the equipment noted in the tests was that a certain number of ballots were not being processed (were being treated as unreadable) by the machines. Approximately 1.5% of the ballots were so treated by each of the two different units being tested. According to the report, "non-processed [ballot] cards were not visibly different from those accepted and tabulated, nor were they always the same cards on successive runs." [67]
The vote-counting equipment was used in a special election at about the time of the test, and the report notes that:
"The frequency of non-processed ballots [5.22%] was observed in several precincts to be significantly higher than that observed during testing. This is attributed to improper insertion of the card by the voter, namely, failure to insert the card vertically and release it cleanly....We attribute this rate primarily to voter unfamiliarity with the system...."
The report recommended that:
"Although the [vendor's equipment] is judged to comply with all applicable statutes and regulations,....as [one of four] desirable product improvements, the vendor should be encouraged to reduce the frequency of random non-processing of acceptable ballots."
During the November 4, 1986 general election, the number of non-processed ballots was over 2% in a significant number of precincts. According to State rules, the county Board of Elections "has the authority" [68] (but is not required) to recount precincts with over 2% non-processed ballots. The county board has used its discretion in selecting particular precincts for reprocessing. Reprocessing, if done at all, is done on the county's central computer. Not all precincts with over 2% non-processed ballots were reprocessed in the November, 1986 general election.
Ballots that are not reprocessed and read by the central computer would never be counted at all, except under a court-ordered manual recount. There are no State or county rules which would permit non-processed ballots to be counted manually in order to have the manual results added to those results already obtained by machine.
Results of the 1986 general election in Oklahoma County show, in many cases, a lack of reconciliation of the number of voters signed in at each precinct with the number of ballots cast. Table 1 below demonstrates that fact.
Ballots Cast
|
Pct. |
A |
B |
C |
NP |
Total |
Voters Times 3 |
% NP |
R |
|
1 |
1036 |
1047 |
1063 |
104 |
3250 |
3261 |
3.2 |
|
|
6 |
513 |
516 |
521 |
20 |
1570 |
1557 |
1.3 |
R |
|
10 |
389 |
396 |
400 |
48 |
1233 |
1221 |
3.9 |
R |
|
34 |
897 |
942 |
976 |
242 |
3057 |
3003 |
7.9 |
R |
|
39 |
1014 |
1094 |
1092 |
168 |
3368 |
3372 |
5.0 |
|
|
59 |
370 |
374 |
381 |
47 |
1172 |
1173 |
4.0 |
|
|
61 |
37 |
38 |
38 |
4 |
117 |
117 |
3.4 |
|
|
72 |
65 |
71 |
71 |
6 |
213 |
213 |
2.8 |
|
|
82 |
708 |
722 |
775 |
350 |
2555 |
2481 |
13.7 |
R |
|
98 |
380 |
398 |
406 |
46 |
1230 |
1284 |
3.7 |
|
|
106 |
546 |
514 |
590 |
201 |
1851 |
1857 |
10.9 |
|
|
117 |
22 |
26 |
24 |
7 |
79 |
78 |
8.9 |
R |
|
122 |
870 |
1002 |
987 |
350 |
3209 |
3126 |
10.9 |
R |
|
126 |
250 |
257 |
261 |
36 |
804 |
807 |
4.5 |
|
|
131 |
10 |
11 |
11 |
0 |
32 |
33 |
0.0 |
R |
|
135 |
156 |
284 |
340 |
350 |
1130 |
1047 |
31.0 |
R |
|
136 |
104 |
107 |
109 |
7 |
327 |
327 |
2.1 |
R |
|
154 |
164 |
186 |
187 |
46 |
583 |
570 |
7.9 |
R |
|
159 |
663 |
861 |
905 |
489 |
2918 |
2820 |
16.8 |
R |
|
161 |
904 |
948 |
950 |
110 |
2912 |
2889 |
3.8 |
R |
|
202 |
16 |
16 |
17 |
4 |
53 |
51 |
7.5 |
|
|
208 |
116 |
121 |
123 |
14 |
374 |
375 |
3.7 |
|
|
222 |
539 |
578 |
585 |
197 |
1899 |
1857 |
10.4 |
R |
|
256 |
249 |
258 |
266 |
29 |
802 |
807 |
3.6 |
|
|
268 |
682 |
697 |
696 |
51 |
2126 |
2154 |
2.4 |
|
|
270 |
953 |
1224 |
1319 |
703 |
4199 |
4062 |
16.7 |
R |
In this election, each voter was given three ballot cards, designated as A, B, and C. The number of processed A, B, and C ballot cards and the number of NP (non-processed) ballot cards are totalled in Table 1 for selected precincts. The total of the ballots tabulated (Total column) may be compared with three times the number of voters signed in at each precinct (Voters Times 3 column), as shown in the table. Values in these two columns in the table for the same precinct differ in most cases. According to a January 25, 1987 article in The Sunday Oklahoman entitled "Security of Elections Described," [69] "an examination of the ballot accounting forms used in last November's election in Oklahoma County revealed that a number of them are neither filled out nor signed." In addition, said the article, precinct voting materials are not logged in on a time sheet when received at the central location, except for the first and last precincts.
The "%NP" column in Table 1 indicates the percentage of non-processed ballots, over all ballots counted. The "R" column indicates whether, as a result of the non-processed ballots, the precinct was recounted on the county's central computer. Several precincts with significant percentages of non-processed ballots were not recounted, at the discretion of the County Election Board.
In most of the precincts identified in Table 1 that were recounted, the total number of ballots counted exceeds the three times the number of voters. From this situation, it may be inferred that the recounting of non-processed ballots (sometimes up to four times in an effort to get them to be read) was not properly accounted, and repetitive attempts at reading added incorrectly to the total number of ballots. The failure to match totals of ballots fed into the machines against voters signed in calls into question the reported individual candidate totals, as no proper cross-foot total can be obtained.
The failure of proper accounting naturally raises the issue of a manual recount. Although there was no request for a manual recount in this election, there have been such requests in other elections in Oklahoma County. It has been the position of the Oklahoma County Election Board that State law, until recently, did not allow manual recounting, since the Board's interpretation of State law is that the same system that was used for the original count must be used for recounting. However, this interpretation has been continually challenged in the courts and has been overturned. There have been manual recounts in Oklahoma County, over the protestations of the Election Board. In the most recent session of the State legislature, a law was passed allowing a recount petitioner to select either a manual recount or a machine recount, in those counties that use vote-tallying devices.
In addition, during the November 4, 1986, general election, over one-third of the 273 voting machines used in the election failed in some manner, some more than once. The most prevalent type of failure was that the machine simply stopped accepting ballots. [70]
Another anomaly of the reported results of this election in Oklahoma County is that the lower-level offices and obscure State questions on the ballot appeared to be as popular with voters as the office of governor. That is, the traditional "fall off" of voter interest in the lower-level offices and State questions did not occur, at least according to the reported results.
This condition is shown in Table 2 below. The votes for the offices of governor, State representative, and on State question #589 are given. The office of governor appeared on ballot card A with other State-wide and Federal offices. The State question appeared on ballot card B, and the office of State representative appeared on ballot card C.
Table 2
|
Precinct |
Votes for Governor |
Votes for St. Rep. |
Votes for Question #589 |
|
1 |
1025 |
1039 |
982 |
|
6 |
509 |
515 |
484 |
|
10 |
379 |
398 |
359 |
|
34 |
881 |
941 |
914 |
|
39 |
989 |
1032 |
1038 |
|
59 |
362 |
367 |
343 |
|
61 |
37 |
38 |
37 |
|
72 |
64 |
69 |
69 |
|
82 |
696 |
Not reported |
665 |
|
98 |
376 |
389 |
351 |
|
106 |
540 |
581 |
474 |
|
117 |
21 |
23 |
25 |
|
122 |
855 |
962 |
918 |
|
126 |
248 |
255 |
228 |
|
131 |
10 |
11 |
10 |
|
135 |
156 |
323 |
258 |
|
136 |
103 |
106 |
104 |
|
154 |
162 |
180 |
168 |
|
159 |
652 |
878 |
808 |
|
161 |
885 |
927 |
899 |
|
202 |
16 |
17 |
16 |
|
208 |
115 |
117 |
117 |
|
222 |
529 |
557 |