What exactly is a “voter verifiable audit trail”?

[MGKrebs]

There certainly appears to be a POTENTIAL for fraud with the BBV system now in place, and hopefully we will find out if there was. But, moving forward, what are the possible solutions? Most everything I have seen are vague references to a “voter verifiable audit trail”. But when we look at the details, they are just talking about pinting a paper receipt of the electronic vote. Personally, I have about ZERO confidence that this is any better than seeing it on a screen. After all, if the program can make a “fake” result show up on the screen, it can just as easily make it show up in a printer. The printed ballots would only be “counted” during a recount, which to my to understanding only occurs in most places when the totals are within about 1/2 of 1%.

If there was fraud, we need to pursue it. But whether there was fraud or not, we need to make sure what we are asking for is better than what we have now. What is your vision for a proper system?

[Salviati]

1. Well for starters:

I'm also unhappy with just getting a 'reciept' of my vote. About the only thing that I'd be satisfied with is that a paper record of each vote is kept, a reciept for me, and one that I can see and watch it get placed in a box. Under any circumstances where a recount is to be performed, it should be these paper ballots that are counted, and they should also be counted and checked against the electronic totals in random spot checks.

[Kelvin Mace]

3. The problem with you getting

a receipt would be the potential for selling your vote. If you see the ballot that you insert into the ballot box, you can have much greater confidence in the system than you can currently have.

A machine printed ballot has the major advantage of being unambiguous in the event of a manual count.

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[WhoCountsTheVotes]

25. I say yes to a machine printed ballot

I want to be able to read the ballot, I want the machine to be able to count the ballot, and I want the ballots to be a permanent audit trail that can be recounted by hand if necessary.

[Brian Sweat]

28. I understand you concern vis-a-vis vote selling

but there is nothing to prevent that now. Absentee and mail-in ballots make the concept of a secret ballot obsolete. In the 2000 presidential election, the entire state of Oregon voted via mail-in ballots. Even though it was illegal, hundreds of thousand of people in Florida voted absentee simply for the sake of convenience. There is also talk of enternet voting. This would also make it possible to sell your vote.


One way to make vote buying less attractive would be to create an "official" counterfit receipt. When you go to vote, you can get a real receipt and a fake one. The receipts would have a code that would allow only authorized election officials to determine which ones are real and which ones aren't. That way if you boss insists on seeing your reciept to make sure you voted for the right candidate, you can use the fake receipt and you boss will not be able to tell it is fake.

[Kelvin Mace]

2. Not quite...

First of all, the word to use is "ballot", not "receipt". Ballots may be counted, receipts may not. When you cast your vote, a paper ballot is printed. You then insert the ballot in a ballot box.

At the end of the election, random precints (say 5% of the total) are audited and the paper ballots are compared to the machine count.

If the totals don't match, there are three possibilities:

1) The paper ballots were miscounted (count again).

2) The hardware/software malfunctioned. Techs/programmers are brought in to test hardware.

3) If #1 & #2 are not the problem, call the FBI, you have vote tampering.

Also, a recount can be called by any candidate if he doesn't like the result. BUT, if the count is cool, he pays for the recount. If the count is wrong, the state pays.

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[gristy]

5. excellent

Nice to meet you, Mr. David Allen.

[Kelvin Mace]

8. Thanks!

<g>

[deek]

17. thank you

for the concise explanation

[gristy]

4. You don't keep the "receipt"

In fact, calling it a receipt is what causes much confusion. It should be called a "voter verified paper ballot". Optical scan voting systems has such things inherently, since your paper ballot is what is scanned and can be re-scanned or counted by hand in a recount. In the case of DRE, what is being proposed (and asked for) is that the machine print a completed (as per the votes entered electronically) paper ballot which is then deposited in a ballot box. These paper ballots are then used in any recount, whether for an audit (say, 1% of all precincts) or for a 100% recount in the case of a contested election.

Personally, I prefer a system where a touchscreen system does NOT count ANY votes. All it is is a system that facilitates the completion of a paper ballot which is then optically scanned (or re-scanned or counted by hand in a recount). Such a system could exist side-by-side with existing paper/optical-scan systems in use in many states.

The vote should NOT be counted electronically by the same machine on which the vote is cast. This position is held by many orgs (such as Caltech-MIT Voting Technology Project) and documented in many posts on DU.

[MGKrebs]

6. Thank you.

"The vote should NOT be counted electronically by the same machine on which the vote is cast. This position is held by many orgs (such as Caltech-MIT Voting Technology Project)"

This makes sense. I will keep looking around, but that is an excellent "bottom line".

[Kelvin Mace]

7. A good suggestion

Another idea I was discussing with several programmer friends was that the paper ballot also produce a barcode with the result of each race beside the name, for example:
----------------------------------
For President, you voted for:

Howard Dean (D) BARCODE
----------------------------------
This would mean that ballots could be counted quickly and accurately with a scanner. Each ballot would have a unique ID number (in no way associated with the voter) that would prevent scanning the same ballot twice.

A simple display would allow the person scanning to see that the barcode scanned was the same as the person voted for.

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[RedEagle]

9. Voter Verified Paper Ballots

David,

It is my understanding that the companies that make the voter-verified paper ballot machines do print a code on the paper that can be scanned later-it is hoped, by a different machine. Of course, a certain number races should always be hand counted.

What keeps getting missed here is that the voter will LOOK at the paper ballot and VERIFY that it's correct. That happens before the final, "cast vote" button is pushed. There are ways to spoil the ballot, if need be. But it's the fact that the voter has looked at the ballot and confirmed THAT copy of the vote is correct, that is so important.

A computer is just a fancy, expensive secretary taking notes for you. If the note taking is wrong, and you have no means of checking on it, then the records generated will be in error, and that error will also go on file. (computer storage mediums) You can duplicate storage mediums, like photocopying a page to insert in multiple reports, but if the information entered is wrong, it's wrong everywhere.

Voter verification says what it means, "I looked at the paper and, yep, that's what it's supposed to say."

[Kelvin Mace]

20. I thought I made that

plain, but I guess there was still room for question. <g> The voter sees his/her ballot and verifies it is correct.

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[Pobeka]

12. Barcodes not good

Because the voter can't look at a barcode and know what it means.

And then, of course, you're using another electronic voting machine (scanner), to verify the first voting machine.

I want human beings, one Rep, one Dem, and one Ind to visually look at a piece of paper with unambiguous marks on it to do an audit.

[Kelvin Mace]

21. There will be that ability...

I just said include the barcode for faster scanning (plus barcodes are more accurate than OCR).

I have not objections to a computer simply generating a ballot with a barcode beside the name (as I illstrated above) and a separate machine tallying the votes.

Spot checking can be done as ballots are scanned by comparing the vote cast with the vote scanned into the system.

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[BevHarris]

10. The voter-verified audit trail is only 50% of the solution

Well, actually about 40% of the solution.

The reason it's better than what is on the screen, though, is that the voter verifies something physical that becomes an independent source to check against the machine. The critical part is "independent source." That is exactly why the IRS requires you to keep receipts (not computer tallies). The receipts are verified by the vendor, who is independent from you. The paper ballot is verified by the voter, whereas what's inside the machine is verified only by the machine.

Now, the auditing is a real problem. They need several kinds of spot-check audits, and Rush Holt's bill only addresses one kind, the random spot-check audit of 1/2 percent (sometimes 1 percent, as in California).

That is not an appropriate audit mechanism for catching fraud. What needs to be added to that to create a more robust audit trail is a set of "triggered" audits plus discretionary audits.

Triggered audits must take place when anomalies are spotted. Hell, we could have EVERY candidate get 18181 votes right now, and in many states we would not be allowed to audit that using the paper trail. Bizarre results need to trigger an audit, and that needs to be written into the law. I go into the specifics in this in my book a bit more, as to what kinds of things should trigger an automatic audit.

Discretionary audits are a great idea. They are done in Washington State. The parties get to choose up to three precincts per county to audit. That would be good, because when candidates think something "looks suspicious" they could choose to audit. It would be kind of like when you pick a jury, you get to choose a limited number of prospective jurors and say "no." Only in this case, the party would choose a limited number of precincts and say "hand-audit that."

There are a number of ways to make auditing much more robust, at very little cost. Actually, some of those solutions were proposed right here on DU, and made it into my book.

Bev Harris

[BevHarris]

11. OH, Hi David! (He was very creative and helpful about audit ideas)

Bev

[Kelvin Mace]

22. please understand

I am not proposing the "ultimate solution" just throwing out suggestions for discussion. This is how we can build a better voting solution. <g>

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[Pobeka]

13. Bev, see the thread "Preliminary simulation results" on bbv.org

I posted a second message there about the 18,181 vote totals.

(under Unexplained Curiosities)

[BevHarris]

14. Oh yeah, this is very good stuff Pobeka.

Coming from an entirely different angle altogether, we are arriving at a very similar destination. But it is tedious work, and requires eyeballs on the code, in this case, several thousand lines of code. We had a productive day, as apparently you did.

Bev Harris

P.S. And for those who will point out that the 18181 were not on Diebold machines, in this case, that is not relevant. The issue is whether presets can produce 18181-like anomalies.

[Pobeka]

16. Being a programmer using a lot of math and statistics every day

You can't keep me from thinking about this stuff.

-- Keep up the good work!

Edit typo

[Pobeka]

19. A standardized database of election results

Would be worth a million dollars (well, to me at least).

It would be fascinating to do an analysis of the entire election results nation wide the way I looked at Comal County, TX. One thing that helps when you're looking at low probabilities as we have here, is to get a lot more data so any "signals" in the data can start to appear and be credible. Those signals of interest would be anomolies correlated with Diebold equipment.

[Brian Sweat]

29. How about this?

All ballots are digitized and stored on servers accessable via the internet. Then each party can have volunteers audit every precinct.

A blank and white ballot should not require more than about 25K of drive space, if that much. A million ballots would be about about 25 gigabytes. All of the ballots in the country could probably be stored on three or four really big hard drives, but I think it would be best to store them at the county level or maybe even the precinct level in larger counties.

[MrPrax]

15. I Now See Why Bev Was Worried

A paper receipt...like any receipt (cashier tape, ATM print-out, etc) is at least something to go on
Some idea that 'maybe' receipts will be bought and sold by the desperate seems more like an old 19th century 'fear' of drunks from every bar on the Southside and every conscripted man in a barracks...
Or 'receipts' might be forged...
Seems a little beyond the real debate of how best to protect democracy

just a thought

[BevHarris]

18. Hey, Mr. Prax, welcome to DU!

Here's another reason they need to be in the ballot box, not carted around town in the voter's pocket:

To audit the total, you need the total number of votes. Mighty hard to run around town asking everyone to dig into their pockets to get a receipt. Just checking your own receipt does nothing to verify the TOTAL.

Bev

[Kelvin Mace]

24. ballot versus receipt

In discussing the problem, it is important to not use the term receipt. A receipt is not a ballot (remember we are delaing with lawyers here, so words are critical). A receipt would have no legal standing in a recount.

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[SoCalDem]

23. Simplified..

Precinct #666 has 395 registered voters

at the end of the day, the machines' counters register that 340 people voted..

each machine has a paper audit trail...

candidate a= 210
candidate b= 130
total 340

The audit trail is one reason that we NEED a "no vote" option..

There are people who , for whatever reason, decide NOT to vote for a particular office.. that SHOULD be registered a s "no vote", so that the integrity of the total count could be maintained..

For at least TWO cycles, BOTH the paper and the electronic trails should be used.. If people have no confidence in the new system, it will only depress voting even more..:(

[jimmynochad]

27. Put it all together and you get...

the Avante machine. It prints the paper record for the voter to see. The voter can spoil it if they see it to be incorrect and print another one. The paper is under "glass" so the voter can not touch it or mark it or put their own forged one in the box. The paper is cut and falls by gravity into the box (to ensure a somewhat random shuffle of the paper to not reveal a voter's identity). The paper has both bar code, some security check codes, the choices in a foreign language (for those that voted in another language), the choices in english for the official reading, and a ballot style code.

They also claim no residual votes because they have the "skip contest" button which is your protest vote of "none of the above". They only show one contest at a time without a next button so the voter is forced to choose a candidate, do a write-in, or skip the contest. This means no more guessing voter intent. Also, people in equals votes out.

Recounts and audit checks are procedural issues at this point. The paper can be scanned, read, whatever makes people happy.

The other issue is the blind voter. This machine will read the paper to the blind voter so the blind voter can "see" the paper also. There are just no other ways around this issue for the blind. The blind groups are against the paper because they are told their privacy is given away or that the ADA law is not met. All of that is just wrong. I would imagine that they just do not appreciate what the problems are when paper is not used.

Keeping the paper under "glass" eliminates the paper jams that the big guys scream about. The printers used are thermal printers (no ink cartridges) and are used in thousands of kiosk operations. Diebold probably is the expert in deploying kiosk printers which is ironic. I have never had an ATM receipt jam in my life. Anyone else?

OK, back in my cage...

[Brian Sweat]

30. Ballots printed on thermal paper would be very easy to spoil.

A lazer printer with a high capacity drum and toner kit would be better. By law the drum and toner should be replaced before every election.

[Kelvin Mace]

26. Another thing to consider about audit trails....

there is one way to create a relatively tamper-proof audit trail, and that is to have the CVM record all actions that occur (votes cast, corrections or adjustments to the machine etc.) on a CD-R. You can't erase or edit a CD-R, only destroy it, which should be cause for an immediate gloves-off audit if it occurs.

David Allen
Publisher, CEO, Janitor
Plan Nine Publishing
1237 Elon Place
High Point, NC 27263
http://www.plan9.org

[MGKrebs]

31. Yikes. This is complicated.

I had been thinking that a second machine, something like a bar-code reader, would be satisfactory, but it would have to be certified to not be in communication with any other machine. But with wireless com, we can't really do a visual inspection to check that, so we're back to where we are now...trusting the certification.

Thanks for the info, y'all. I'm catching up after missing a lot of this recently.

When is the book due, Bev?