ACLU material is in plain type, comments are in
bold type.
Policy #322b
As of November 20, 2007
1 Irregularities in the conduct of elections (including the malfunction of voting equipment)
2 have created a crisis of confidence in the U.S. electoral system. The U.S. electoral system
3 is a process that begins with voter registration and ends with final certification of election
4 results. There are many components of this process, voting being one of them. This
5 policy addresses only voting, which is a discrete system within the electoral process.
Comment 1. The “crisis of confidence” is based not only on irregularities and equipment malfunctions, but even more on the failure of any governmental body or good government group to respond reasonably to them.
For example, we hear that “no one has ever proven that DREs have been used for fraud” but we see that no court has allowed complete evidence to be gathered after irregularities, and organizations such as ACLU have looked the other way along with the relevant governmental bodies.
Vendors and election officials routinely blame equipment malfunctions on “poorly trained voters and poll workers” even when the equipment is obviously at fault – but no governmental body or good government group responds with appropriate demands for investigation, gathering of evidence, or the return to low-tech election equipment that is manageable for voters, poll workers, and local election staff.
6 In many U.S. jurisdictions, elections authorities have installed electronic voting systems
7 that are based on Direct Recording Electronic machines ("DREs")[1]. These systems have
8 been purchased (sometimes in response to legislative mandates) in an effort to address
9 election irregularities while increasing participation by voters who have disabilities or
10 who are not proficient in English.
Comment 2. Perhaps some DREs were purchased to serve
these positive purposes. It is disingenuous for the ACLU to suggest, however,
that no one (including ACLU) was aware of the potential for undetectable fraud
in using machines which, when the Help America Vote Act was passed and most of
these machine were being purchased, had these characteristics:
10 In order to maximize electoral participation through
11 increased voter confidence, while at the same time minimizing the risks of security
12 breaches, fraud, inaccuracies, and malfunctions, jurisdictions that adopt electronic voting
13 systems must adhere to the following principles:
Comment 3. Electoral participation and voter confidence are both based on understanding election procedures and participating in them.
DREs eliminate opportunities for ordinary non-technical citizens to participate in the conduct of elections as observers. DREs also mystify poll workers, and prevent anyone from knowing how the votes are recorded, cast, stored, handled, and counted.
Participation and confidence cannot be built on telling citizens “don’t worry, a computer expert says the machines work.”
Comment 4. It is impossible for jurisdictions using DREs to effectively “minimize” security breaches, fraud, inaccuracies, and malfunctions, because only the vendors know their own secret software and how their systems work.
Comment 5. Minimizing risks is an insufficient goal.
By introducing DREs into our elections we have introduced risks that are widely recognized as unmanageable, undetectable, and capable of enabling “wholesale” fraud (enabling a single person or a small group to control the outcome of all elections in entire states). We have also introduced the ability of interests outside of the election community to control the outcome of local elections by remote communication.
These risks are new, uncontrollable, and not clearly understood by election professionals. Yet these risks can be eliminated by reverting to simpler, low-tech election technologies.
The risks introduced by DREs are not offset by any benefits. The supposed benefits of DREs (accessibility to voters with special needs) can all be achieved with low-tech and even non-computerized assistive devices.
14 Accuracy and Fairness: To ensure fair elections, a voting system must accurately record
15 votes as cast by the voters, and it must accurately count, tabulate and report them to the
16 election authorities and the general public.
Comment 6. Of course this statement is true, but how can the ACLU harmonize this principle with any use of DREs? DRE voting systems have never been shown to accurately record, count, tabulate or report votes in real elections. Meanwhile thousands of documented irregularities in real elections have not been appropriately investigated. Most DREs have communications capability which enables undetectable remote tampering with votes.
Comment 7. “Accuracy” is not a characteristic of
computers, it is a conclusion that can be drawn only after an audit shows that
the computer worked accurately. The only way to determine if a computer is
working accurately is to audit it. Doug Lewis in testimony to Congress has made
clear that the election industry has no intention of doing this kind of
computer audit.
www.wheresthepaper.org/HouseAdminTestimonyDougLewis3_20_2007.pdf
16 Officials must be especially alert to system
17 design flaws, inaccuracies, or other conditions that have the purpose or effect of
18 excluding categories of voters, for instance, racial minorities, low income persons, or
19 felons who have been be re-enfranchised. Voting systems must prevent overvoting and
20 must provide notice to the voter of undervoting.
Comment 8. Since DREs use secret software, jurisdictions have no technical knowledge of their DREs and cannot assess their design flaws. Even if the software were open-source, jurisdictions lack the resources to read and evaluate it. Even if jurisdictions had the resources, all computer experts agree that it is impossible to guarantee that software contains no malicious code or errors by reading it. In the professional world, computer systems are evaluated by auditing the work they do, not by reading software.
Comment 9. It is unclear what the ACLU wishes to achieve by saying that officials must be “alert” to various problems. Election integrity activists, computer experts, and some election officials have already found severe design flaws in DRE systems, as well as “conditions that have the purpose or effect of excluding categories of voters.” This has not prevented the continued use of such systems.
Comment 10. DREs that can display ballots in non-English language have the dual characteristic of being able to assist voters who cannot read English, and to target them for blanked out or changed votes. There is evidence that such language profiling has already taken place. It is improper for a voting machine to know a voter’s language when recording, casting, storing, handling, or counting his or her votes. Paper ballots printed in both English and a minority language provide assistance to voters who cannot read English without the risk of profiling. It is unclear why the ACLU omits language minorities as a category of voters to be protected.
Comment 11. The ACLU appears to be concerned only with “categories of voters.” However, if election outcomes are altered by computerized means, all voters would be disenfranchised and the foundation of all civil liberties – a legitimately elected government – would be lost.
21 Verifiability: Every voting system must have a means by which the vote can be reliably
22 recounted in order to verify the accuracy of the electronic vote record and, if necessary,
23 re-tabulate the vote. Any true independent recount system must do more than merely re-
24 examine the same electronic records that were tabulated in the initial count. To ensure
25 verifiability, it must be a system that operates independently of the initial count, so that
26 any problems in the initial count are not duplicated in a recount[2].
Comment 12. Verifiability means nothing unless jurisdictions have the will and means to verify. American jurisdictions have neither, and should not use voting equipment that requires verification.
Verifying electronic vote records requires a complete audit of all election data, a process that can take weeks or months. No jurisdiction would be willing to wait so long to certify its election results.
It is better to use equipment that enables simple, appropriate observation of procedures. The term “appropriate” here means (a) voters must be able to witness the votes that they cast that will be counted for election night tallies (rather than placebo images on a screen or paper trail that will not be counted), and (b) once the votes are cast, observers must be able to watch the ballot boxes, ballots, and counting procedures until the election is certified.
Comment 13. DREs enable undetectable alteration of votes prior to counting and verification. Any focus on counting and verification must be balanced with focus on the votes themselves – ensuring that the votes to be counted and verified are those intended by voters.
27 Accessibility: Older voting technologies generally have not provided adequate
28 accessibility for voters with disabilities and members of language minorities. New
29 electronic technologies which can provide such access should be implemented as soon as
30 possible. Voting systems must be fully accessible to every eligible voter. Voting systems
31 must not disenfranchise any class of voter. Accommodations must be made to allow
32 voters such as those with disabilities, language barriers, or low literacy levels to vote
33 privately and independently. Likewise, voting systems must not be so complicated,
34 confusing, or time consuming that they deter or intimidate any voters, particularly voters
35 from any minority group which would face cultural barriers to using a particular voting
36 system.
Comment 14. Superior or equal accessibility can be achieved with low-tech and non-electronic equipment. Accessibility for language minorities does not require special assistance -- it can be achieved by printing ballots in both English and the minority language. ACLU should not endorse “electronic technologies” for accessibility since such equipment is unnecessary and invites insurmountable risks. See Comments 4 and 5.
The ACLU is not serving voters with special needs by encouraging the use of equipment that may disenfranchise all voters, including those with special needs.
See also Comment 10 on language minorities.
37 Anonymity: The right to cast a secret ballot is a basic civil liberty. The ability to vote
38 anonymously is essential to protect the privacy of the voter, and to prevent fraud related
39 to vote buying or coercion. Voting systems must be designed in ways that do not
40 compromise anonymity of voting.
Comment 15. When using computers to record, cast, store, handle, and count votes, we must broaden our concerns beyond old-fashioned, simple, and well-understood types of low-tech fraud such as vote buying and coercion. For example, we must consider profiling by use of language, type of disability, geographic location, and other voter characteristics.
When using electronic poll books in addition to DREs, the assumption that the voter’s identity will never be associated with his or her ballot is naïve or corrupt.
At least two DRE systems currently in use are known to violate anonymity, yet jurisdictions continue to use them.
See also Comment 10 on language minorities.
41 Security: A voting system must be designed and operated so as to prevent, to the greatest
42 extent possible, negligent programming errors, negligent operational errors, or malicious
43 tampering which could lead to election fraud. In addition electronic voting equipment
44 should be maintained secure from external conditions such as weather, electrical
45 fluctuations, or other environmental conditions which could impair accuracy.
Comment 16. No computer system can be secured against tampering by persons who work with it. The FBI Computer Crime Survey of 2005 showed that 44% of organizations reported intrusions into their computer systems from within their own organization. Boards of Elections would be at least this vulnerable, but probably more vulnerable due to lack of knowledge of computer security and the high motivation to alter election outcomes by partisan staff.
“Security,” like accuracy, is not a characteristic of computer systems. It is a conclusion that can be drawn only after independent audit shows that the results of normal operation are accurate.
"Auditing" is any procedure that enables you to confirm that the results of normal operation are accurate, or to identify inaccuracies that need correction.
Due to rapid advances in computer technology and innovative electronic communications, a system that is secure today may become insecure tomorrow, and jurisdictions would learn of the problem only after the security has been breached -- if at all.
Comment 17. Local jurisdictions are unlikely to use appropriate security procedures. DREs were sold to them as burden-free election machines, and they don’t want security procedures to be imposed upon them now. One indication of this is the universal acceptance of tiny spot-checks rather than 100% audits of voting equipment. Another is the many California county election officials' furious denunciations of their Secretary of State Debra Bowen and the security procedures she published after conducting a “Top to Bottom Review” of electronic voting systems.
46 Standards and Oversight: Voting systems must be subject to independent testing,
47 certification and verification of their operational soundness. The ACLU calls for the
48 creation of truly independent election oversight bodies to develop these standards and
50 process.
Comment 18. Elections are about votes and ballots, not computers. The ACLU should call for truly independent oversight, standards and monitoring of elections, and the elimination of DREs. DREs are unnecessary to achieve the objective of accessibility that the ACLU professes to seek, and they introduce insurmountable risks of undetectable, wholesale fraud.
Instead, the ACLU is urging citizens and civic groups to engage in a fools errand that would require prodigious time, effort, and money. Technology cannot replace citizen understanding and observation of votes, ballots, and election procedures.
ACLU should encourage citizens to participate in their local elections by working at the polls and observing all procedures with votes and ballots. This solution is not just feasible, inexpensive, quickly-implemented, and simple. It would also reveal to Americans how far we have strayed from elections that can be trusted, and create a nation of engaged, knowledgeable citizens.
Participation is the key to voter confidence. Computers shut people out, and turn elections into “trust us” public rituals that cannot support legitimate democratic government.
50 More effective public oversight of an electronic voting system's accuracy,
51 security, and verifiability should be achieved by, at a minimum, adopting some version of
52 "open source code" software. This means that a voting system's computer programming
53 should be made available to the public for analysis and testing.
Comment 19. Open software is important, but reading software cannot replace appropriate observation of understandable and visible procedures with votes and ballots from the time the votes are cast until the election is certified.
Moreover, no one can control what software is in DREs during an election, especially since most DREs have remote communications capability.
Comment 20. WHAT CAN ACLU DO? Courts, election officials and vendors have successfully rebuffed demands by voters and candidates to routinely examine equipment before and after elections to verify correct setup, and to examine equipment after irregularities have occurred. ACLU could work to secure such access to equipment, and establish the right to gather evidence.
Boards of Elections have delegated responsibility for conducting some parts of elections to private vendors of electronic voting systems. ACLU could work to ensure that public bodies given the authority to act for the public do not improperly hand over their authority to private companies.
ACLU could challenge limitations and prohibitions against (1) citizen observation of procedures, (2) recounts, and (3) public access to election records such as ballot definitions, numbers of voters who signed in versus numbers of ballots cast, etc.
Policy #322b,
Electronic Voting Systems
[1] A Direct Recording
Electronic (DRE) machine interacts with the voter and records votes directly in
electronic
form. A touchscreen machine is one
where the voter indicates her vote to the machine via a
touchscreen
interface. Today, many DREs are
touchscreen machines. However, not all
DREs use a
touchscreen,
and not all touchscreen machines are DREs.
For instance, ballot marking devices, where the
voter
uses a touchscreen to indicate her choice and then a paper ballot is printed,
provide one example of a
touchscreen
system that is not a DRE. These ballots
may be counted using optical scan equipment.
[2] For example the system
should, at a minimum:
a. Produce an independent record of the final
feedback the voter sensed (saw heard and/or felt) indicating
the independent vote at the time the vote
was cast;
b. Maintain that record securely against
alteration;
c. Prevent the addition or subtraction of any
language;
d. Allow multiple and accurate counts to be
made of such records.