A PC-Based Open-Source Voting Machine with an Accessible Voter-Verifiable Paper Ballot Arthur M
Total Page:16
File Type:pdf, Size:1020Kb
A PC-Based Open-Source Voting Machine with an Accessible Voter-Verifiable Paper Ballot Arthur M. Keller, UC Santa Cruz and Open Voting Consortium [email protected] Alan Dechert, Open Voting Consortium [email protected] Karl Auerbach, InterWorking Labs [email protected] David Mertz, Gnosis Software, Inc. [email protected] Amy Pearl, Software Innovations [email protected] Joseph Lorenzo Hall, UC Berkeley SIMS [email protected] 1. Introduction voter's choices for the election and for any recount of that election. Open Voting ballots are machine-readable Voting is the foundation of a democratic system of and may be tabulated (and re-tabulated in the case of a government, whether the system uses direct or recount) either by computer or by hand. representative governance. The heart of voting is trust that each vote is recorded and tallied with accuracy and Open Voting systems can be engineered to impartiality. There is no shortage of historical examples accommodate the special needs of those who have of attempts to undermine the integrity of electoral physical impairments, or limited reading ability. systems. The paper and mechanical systems we use Many of us today have come to trust many of our today, although far from perfect, are built upon literally financial transactions to ATMs (automatic teller hundreds of years of actual experience. machines). The push for electronic voting machines has There is immense pressure to replace our "dated" paper benefited from that faith in ATMs. However, we are and mechanical systems with computerized systems. starting to learn that that faith is unwarranted. There are many reasons why such systems are First, ATM machines do fail and are often attacked. attractive. These reasons include, cost, speed of voting Those who operate ATMs usually consider the loss rate and tabulation, elimination of ambiguity from things to be a proprietary secret. Banks are well versed in the like "hanging chads," and a belated recognition that actuarial arts and they build into their financial plans many of our traditional systems are not well suited for various means to cover the losses that do occur. In more use by citizens with physical impairments. crude terms, it's only money. However, electronic voting brings a new set of risks Second, voting machines carry a more precious and drawbacks as well as advantages. In response to burden — there is no way to buy insurance or to set the problems and opportunities of electronic voting, the aside a contingency fund to replace a broken or Open Voting Consortium was established. tampered election. The Open Voting Consortium (OVC) is creating an There are several areas of concern regarding the new open source, trustworthy, cost effective, voter verifiable generation of computerized voting machines: voting system using open source software components • No means for the voter to verify that his or her on industry standard computers. A primary element of votes have been tallied properly. this Open Voting system is the use of software through • No means outside of the memories of the voting which the voter creates a printed paper ballot machines themselves to audit or recount the containing his or her choices. Before casting his or her votes. ballot the voter may use other, independently • Lack of ability to audit the quality of the programmed, computers to verify that the ballot software. Fortunately the widespread belief that properly reflects the voter's choices. The voter may also "computers are always right" is fading. Our visually inspect the text printed on the paper ballot. The individual experiences with error-ridden paper ballot is cast by placing it into a ballot box. Once software on personal computers and consumer 1 cast, that paper ballot is the authoritative record of the products (e.g., the BMW 745i ), software errors by even the best-of-the-best (e.g., NASA and the computer technology to that traditional system. loss of the Mars Climate Orbiter2), and the However, unlike some of the other computerized voting possibility that intentional software bugs can be systems that change the basic nature of the traditional hidden so deeply as to be virtually invisible system, our design applies computer technology only in (Ken Thompson's famous 1984 paper — a limited and conservative way. Reflections on Trusting Trust3) have all combined to teach us that we should not trust The OVC design preserves the paper ballot. However, software until that trust has been well earned. under the OVC design the voter marks the ballot using And even then, we ought not to be surprised if a computerized voting station rather than a pencil or unsuspected flaws arise. colored marker. The ballot is printed in plain text that • Vulnerability of the machines or of their the voter can read. Voters have the opportunity to supporting infrastructures to intentional attack or inspect the ballot to ensure that it properly reflects their inadvertent errors. choices. The companies that produce voting machines have The OVC design will preserve the ballot box. Voters poured gasoline onto the smoldering embers of concern. must insert their paper ballots into the ballot box. The Some of these products are built on Microsoft operating OVC ballots will contain a barcode in addition to the systems — operating systems that have a well-earned plain text. This barcode makes it easy for the poll reputation for being penetrable and unsecure.4 And workers to count the ballots10 when the ballot box is most of these companies claim that their systems are opened. full of trade secrets and proprietary information and The OVC design will be a voter-verified voting system. that, as a consequence, their internal workings may not The core difference between this and other systems, be inspected by the public. In addition, these companies such as DRE equipped with printers, is that in the OVC have frequently displayed a degree of hostility (in some design the paper ballot is the actual ballot; information cases, the hostility took the form of lawsuits5) against that might be recorded in computer memories or on those who are concerned about the integrity of these computer media is used only for security, error- products. And finally, their systems have detection, fraud detection/prevention, and auditing. “vulnerabilities [that] do show incompetence” and were built by “programmers [who] simply don’t know how 3. Existing Electronic Voting Machines to design a secure system.”6 There is a widespread perception that these companies are more concerned Existing DRE (Direct Recording Electronic) voting about profits than about fair and trustworthy elections. machines have come under increasing scrutiny with The Help America Vote Act of 20027 was passed into widespread reports of malfunctions, omissions and user law to modernize voting equipment as a result of the interface problems during elections. 2000 US Presidential election and the problems 3.1 Diebold AccuVote TS and TS-X observed in Florida.8 The Federal Election Commission (FEC) has issued a set of Voting System Standards A group led by Avi Rubin and Dan Wallach analyzed (VSS)9 that serve as a model of functional requirements the Diebold AccuVote TS DRE voting machine and 11 that elections systems must meet before they can be found numerous flaws. SAIC was commissioned by certified for use in an election. The next section the state of Maryland to analyze the Diebold voting discusses the existing voting machines that meet those system and found “[t]he system, as implemented in standards. Section 3 considers the rationale for an policy, procedure, and technology, is at high risk of 12 accessible voter-verifiable paper ballot. Section 4 is a compromise.” Based on these reports, the California description of the Open Voting Consortium architecture Secretary of State’s office established security 13 for the polling place. Section 5 mentions the current procedures for DRE voting machines. Diebold was state of the system and next steps for its development. then found to have used uncertified software in 17 14 Conclusion, acknowledgements, and references follow. counties in California. The California Secretary of State then decertified the Diebold and all other DREs 2. OVC System Description on April 30, 2004.15 The OVC system will be very much like a traditional 3.2 Electronic Systems and Software iVotronic system in which the voter enters the polling place, ES&S iVotronic is a poll-worker-activated, marks his or her choices onto a paper ballot, and inserts multilingual touch screen system that records votes on the ballot into a ballot box. Our design applies internal flash memory. A poll worker uses a cartridge- like device called a Personal Electronic Ballot (PEB) to 3.4 Sequoia Voting Systems AVC Edge turn the machine on and enable voting. Voters first choose their ballot language and then make their The Sequoia AVC Edge is a voter-activated selections via a touch screen. When the polls close, poll multilingual touch screen system that records votes on workers read summary data from each machine onto the flash memory. Its operation is very similar to the PEB via infrared. The PEBs are then transported to Diebold AccuVote-TS described above. election headquarters or their contents transmitted via a In March 2002 in Palm Beach County, Florida, the computer network. Edge machines froze up when voters selected their In September 2002 in Florida, a spot check of iVotronic ballot language and other reports indicate votes counted 23 machines revealed several precincts where hundreds of for the wrong candidate. As well, 15 PCMCIA cards voters had only one or even no selections chosen the were temporarily lost and the central system would not their ballots cast on Election Day and vote totals report the results and in a very close race many ballots 24 produced by the main and backup system did not were blank.