Part of the Voting and Elections web
pages
by Douglas W. Jones
THE UNIVERSITY OF
IOWA Department of Computer Science
The classic Australian of paper ballot provides an
excellent introduction to the system of checks and balances used to assure
voter privacy and an accurate vote count in the face of a variety of threats.
In this system, first used in the province of Victoria, Australia in 1858,
voters are issued paper ballots at a polling place, and after the ballot is
marked, voters deposit it in a ballot box. After the polls close, the box is
opened, the ballots are counted by the election judges, and the totals are
reported.
On the face of it, this system looks misleadingly
simple, but the fact that this system was first introduced in the mid 19th
century and the fact that it took decades before variations on this system to
be adopted by other jurisdictions is strong evidence that this was not a
trivial invention!
The threats that must be accounted for in a paper
ballot election include ballot box stuffing and dishonest ballot counting. In
addition, we must guard the privacy of the voter, so that voters are not
subject to harassment (or worse) because of the way they cast their vote.
An analysis of the problem of carrying out an
honest election begins with an enumeration of the different parties in the
process. For each party, we identify of the threats that party poses and the
countermeasures we can take to meet these threats. Historically, the
identification of threats has frequently developed very slowly, with each
threat being clearly addressed only after serious improprieties have been
widely publicized. Many paper ballot voting systems in use today fail to
address several threats, and even in the realm of paper ballots, technological
changes threaten some of the countermeasures that have traditionally proven to
be effective.
·
The rules
given here governing the conduct of an election are not intended to represent
the rules used in any particular jurisdiction, but rather, these rules are but
one example of a reasonable refinement of the Australian ballot.
The primary parties that interest us are the voter
and the election judges, but we are also interested in several others. One
important party is the outsider who tries to buy votes. Another is the agency
that prints the ballots, and finally, we are concerned with assuring the
security of ballot transportation and storage.
The first party we care about in any election
system is the voter! Nobody should be allowed to vote who is not entitled to
vote, and nobody should be allowed to vote more than once.
·
Traditionally,
these two requirements have been enforced by maintaining a voter registration
list at the polling place and checking off each voter on the list as they vote.
One of the primary responsibilities of the election judges at the polling place
is to handle this job.
There is a tradeoff between a rigorous test of
voter identity, on the one hand, and a voting system where polling places are
pleasant, open and inviting to voter participation. A rigorous test of voter
identity could well prove sufficiently inconvenient or even humiliating that
legitimate voters refuse to participate! On the other extreme, if voter
identity is subject to no verification, we have no reason to believe that the
election results reflect the will of the electorate.
It is probable that a system relying on imperfect
tests of voter identity in order to maintain a pleasant atmosphere at the
polling place will most accurately reflect the will of the electorate even
though it tolerates a modest level of fraud. This will be true when the
increase in legitimate turnout resulting from relaxed identity checking more
than offsets the resulting increase in fraud.
Many jurisdictions do not require the voter to
present any form of ID card. This may seem dangerously open to voter fraud, but
there are remarkably simple countermeasures that offer what we usually consider
to be adequate security. For example, if we selectively hire election judges
from within the precinct, there will be a high probability that one or more
judges will actually know many of the voters, making more formal identity
checks unnecessary.
When the voter requests a ballot, we typically
require that the voters name and address be announced so it can easily be heard
by all present. If a person tries to impersonate a legitimate voter or claim
residence at some address, there is a real risk that some other voter, perhaps
a neighbor, will notice! Asking voters to sign a form certifying that they are
indeed legitimate voters in the precinct, we gain additional security by
forcing a voter intent on fraud to commit the added crime of forgery in front
of a large number of witnesses.
If we assure that each voter is only allowed one
trip to the voting booth and ballot box, we still have not prevented the voter
from casting multiple ballots! A voter could, in theory, smuggle a stack of
ballots into a polling place and stuff the lot in the ballot box! This threat
is met by two countermeasures:
·
We require
that the ballot box be out in the open, in clear view of all of the election
judges and of other waiting voters, so that any attempt to stuff the ballot box
would be difficult to conceal.
·
Second, we
institute a system of strict accounting for all ballots issued and voted, and
we print ballots in such a way that they are at least modestly difficult to
counterfeit.
The accounting for ballots typically involves
reconciling the number of ballots found in the ballot box at the end of the
election with the number issued to voters during the voting period and the
number stocked at the polling place at the beginning of the election. At the
end of the day, all ballots must be accounted for as either voted, spoiled or
never issued.
An interesting conflict arises between the
problems of accounting for ballots and the problem of allowing voters to cast
secret ballots. A classic accounting method involves attaching serial numbers
to each ballot and recording these numbers whenever ballots are distributed or
handled.
In order to allow secrecy, ballot forms that
include serial numbers are typically prepared with a perforation between the
main ballot and the tear-off tab where the number is printed. Typically, this
tab is torn off by the election judge at the time the ballot is given to the
voter, and at the close of polls, the number of torn tabs must equal the number
of ballots cast or spoiled.
We must protect voters from outsiders who might
try to punish those who vote "the wrong way" or reward those who vote
"the right way". To protect voters from punishment, we must assure
the voter that his vote is secret. To protect the public from voters willing to
sell their votes, we must be assured that even the voters themselves cannot
prove how they voted in order to claim a reward.
·
Ballot
secrecy requires that the ballot contain no marks that could be used to
identify the voter. Neither preprinted information such as a serial number nor
any kind of personal identification such as a signature can be allowed on the
ballot. When it comes time to count the ballots, the election judges must
reject any ballot containing such information.
Additionally, because both the deposit of ballots
in the ballot box and the counting of ballots are done openly, we must defend
against an observer who notes the the order in which people cast ballots, and
then, later, notes the the votes in the order that they are counted. Voter
privacy will be compromised if these two processes are related!
·
We therefore
require that the votes not be counted in the order they were deposited! Ballot
boxes should not be designed so that the ballots stack neatly and in the order
they were deposited, and when the ballot box is opened for counting, its
contents should be dumped into a disorderly pile on the counting table and not
handled in neat stacks that preserve their order.
An interesting approach to buying votes involves
offering voters pre-voted ballots, along with the promise to buy a blank ballot
from any voter who returns from the polls with one. While the voters are in the
privacy of the voting booth, they are guaranteed to have ample opportunity to
exchange their pre-voted ballot they smuggled into the polls for the blank
ballot that was given to them by the election judges.
This scheme requires only one blank ballot to
start with. After this is marked and deposited by the first voter, the
perpetrator buys a blank ballot from that voter, marks it, and gives it to a
second voter. Thus, a single blank ballot may be used to buy a large number of
votes during the course of an election day.
This is an example of a vote fraud scheme that
only works in the presence of partial security measures. If blank ballots are freely
available, the perpetrator has no way of knowing how the voter got a blank
ballot. If blank ballots are impossible to get, there is no way to get the
single blank ballot needed at the start of the day to begin the scheme. If
there is no polling place security, the perpetrator would have no need to pay
voters to vote, while if every voter was searched on the way in and out,
smuggling pre-voted ballots in and blank ballots out would be impossible.
Clearly, we cannot impose intimidating searches on
voters; too many would be driven away, so we must concentrate on preventing
blank ballots from reaching those intent on committing large-scale vote fraud.
We typically do this by using ballots that are difficult to forge combined with
strict accounting for all ballots printed.
Of course, few ballots are printed with the kind
of anti-forgery measures that are involved in the printing of, for example,
paper money; nonetheless, use of special cardstock and the distinctive print
quality of letterpress printing have traditionally been judged to provided
sufficient security.
The election judges run the polling place and, in
a precinct count system, they count the ballots. If the election judges are
dishonest, they can fix the election any way they want, for example, by
excluding registered voters, allowing non-registered voters to vote, stuffing
the ballot box with extra ballots, discarding ballots that vote against the
position they support, or simply reporting vote totals that are fictional.
We use several tools in order to guard against
such fraud. Of these, the most important is openness. At no time during the
conduct of the election are the judges allowed to take any action in private.
For example:
·
As each
voter is checked against the list of registered voters, the election judge is
required to call the name out, loudly enough that all present can hear.
This allows others present, for example, election
observers, to record the names of those who voted and compare the names with
lists of eligible voters, and it gives a chance for those who may know the
voter by name to recognize that an impostor is attempting to vote.
·
To prove
that the ballot box is empty before the polls are opened, the election judges
open the box and display its empty interior prior to the opening of the polls,
and then close and seal it.
·
For the full
time between the public proof that the ballot box is empty and the time the box
is opened for ballot counting, the box remains sealed, and in addition, it
remains either in public view or in secure storage and transport; it is never
in the private custody of any one person or party.
When the polls close, ballot counting must be
equally open. We cannot trust an election in which we allow the ballot counting
to be carried out in private, behind locked doors.
·
We therefore
require that all ballot counting be done openly, from the time the ballot box
is opened and its contents dumped out for counting until the time the official
totals for the precinct are publically posted.
·
In order to
account for all ballots printed, the count must include a the number of ballots
remaining unvoted, the number of ballots spoiled by voters and replaced at the
polling place, the number of spoiled ballots found in the ballot box, and the
number of valid ballots actually counted.
Additional auditing of the counting process is
possible if, for each race, in addition to counting the number of votes for
each candidate, the number of overvotes and undervotes is also counted.
Undervotes occur when voters fails to cast votes in a race, while overvotes
occur when voters mark more than the permitted number of alternatives. In
simple races, the sum of overvotes, undervotes and votes cast should add up to
the number of ballots deposited in the ballot box. Slightly more complex
accounting allows a similar check on races where voters may vote for more than
one candidate.
·
The
requirement for open election administration may be met by literally inviting
the public, but when this leads to crowding that threatens to interfere with
the election, we must back away and limit attendance to representatives of the
public.
As an example, it is common for political parties
and campaign organizations to assign volunteers to monitor polling places,
noting the names of those who have voted. In addition to supporting partisan
"get out the vote" drives, these observers serve as representatives
of their organizations to monitor the conduct of the election judges.
When the ballot boxes for a multiple-precinct
jurisdiction are checked and sealed at a central location before being
distributed to the polling places, and when full ballot boxes are taken to a
central location for counting, we typically achieve a degree of openness by
allowing each political party or campaign organization to send a limited number
of representatives as observers.
The selection criteria used for designating the
election judges who will administer the polling paces, set up the ballot boxes
and count the votes provide an additional check. If we allowed one party to
control the makeup of these panels that run each polling place, we would open
the process to fraud. Therefore, an open election system must prevent this.
·
We typically
require that, to the extent possible, the judges for each precinct be residents
of that precinct. This ensures that many of the judges will recognize many of
the voters.
·
In addition,
we require that, to the extent possible, members of opposing factions or
political parties be represented in the panel of judges for each precinct.
It is frequently impossible to meet both
requirements; some precincts may have an insufficient number of qualified
people able to work on election day, while others my be so dominated by one or
another party or campaign organization that balance cannot be achieved.
·
Therefore,
we typically provide a mechanism whereby parties and campaign organizations can
suggest judge candidates for each precinct, and the list of judges appointed is
made public prior to the election, so that, if qualified people are overlooked
or the panels are stacked in favor of one party or campaign organization, a
court challenge is possible.
In the United States, with our longstanding of
two-party political tradition, election laws frequently mandate openness by
requiring that members of both major parties be included on the panel of
election judges, or that representatives of both major parties be invited to be
present as observers during ballot box inspection and ballot counting.
Clearly, such wording is not acceptable. In the
first place, in some jurisdictions, there are significant third parties that
ought to be allowed representation. In some elections, there are nonpartisan
races that may be supported by campaign organizations that should be allowed
representation, and in jurisdictions dominated by a single party machine,
opposing factions within that party ought to be allowed representation,
particularly in primary elections.
Therefore, to the extent possible, we should not
talk about representatives of the two major parties, but rather,
representatives of each party or campaign organization.
Voters can inspect their ballots to see if they
have been pre-marked, but such checking can be quite tedious, particularly if
the ballot includes large numbers of issues that most voters would rather
ignore. In addition, after the ballot is deposited in the ballot box, we must
assure voters that no additional marks are added! Therefore, nobody but the
voter must be in a position where they might be tempted to add marks to a
ballot!
·
To meet this
requirement, we forbid those who handle ballots from doing so within reach of
pencils, pens or other marking devices! Election judges who distribute ballots
or interpret ballots must be clearly distinguished from those who mark off
voter names on the list of eligible voters or who make tally marks as the votes
are counted.
Furthermore, election judges themselves could
attempt to buy votes by asking voters to mark their ballots in a distinctive
way in order to identify themselves to the judge actually reading that ballot.
·
To prevent
this, we ask the judges to reject all ballots containing any stray marks; that
is, any marks that might serve any purpose other than indicating an anonymous
vote for a candidate.
The rejection of ballots containing stray marks
imposes a very strict standard on the prohibition against ballot handlers
having any marking implements on them. If dishonest ballot handlers are able to
mark ballots, on seeing ballots containing votes for the wrong candidates, they
could invalidate them by making random marks.
Taking this to an extreme, dishonest ballot
handlers have been known to carefully park fragments of pencil lead under their
fingernails, allowing them to mark a ballot by casually dragging a fingertip
across it. To counter this, election officials in some jurisdictions have been
known to require careful inspection, trimming and cleaning of fingernails prior
to any ballot handling.
The combination of the openness requirement and
this requirement sets the minimum effective size for the panel of election
judges, both at precincts and in vote counting centers.
·
We need at
least two judges, preferably from opposing factions, who actually handle the
ballots, distributing them to voters or inspecting them and calling out their
interpretation of each vote. Independently from them, we need at least two
judges, again, preferably from opposing factions, to mark off names in the
lists of eligible voters and to maintain the tally sheets during counting. If
there is a dispute or confusion, we need an odd number of judges to break ties,
so we need at least five judges on the panel.
In any case, in any multi-precinct election, after
the results for one precinct have been computed, they must be accurately
incorporated into the totals for the election district. This necessarily
involves communication from precinct to regional to state offices, where
successive subtotals are computed, and with each step, errors are possible,
whether deliberate or accidental.
·
As soon as
the judges counting the votes for a precinct arrive at a count that is
consistent, that is, a count that properly accounts for all ballots cast and
where the sums for each candidate are consistent with the numbers of ballots
cast, the results must be publically posted.
This allows observers to reconcile the numbers
with their own observations of the counting, and it permits observers to check
the official district-wide totals by independently computing them.
No requirement for openness or public posting of
results is of any use unless there is some way to challenge an incorrect result
and request that the ballots be re-counted. It is conceivable that an informal
demand for a recount could be handled on the spot, but if this were done, it would
be possible for an observer to arbitrarily delay the completion of the canvass
of an election by repeated informal requests for recounts.
·
Therefore,
there must be a formal mechanism for requesting a recount; outside this formal
mechanism, no recounting should be done once an official total has been posted.
If we allow a recount request at any time, it
would be possible for someone to overturn a close election at any time,
possibly long after someone has begun serving in office. In the event of a
close election, lingering doubts about the outcome could paralyze the
government.
·
Therefore,
we impose a deadline on the right to request a recount. This deadline must be
long enough after the election to allow any questions about the propriety of
the process or correctness of the results to be raised, and it must be before
the term of office begins for the winner of the election. After this deadline,
the election is declared final and no further challenge is allowed.
During the interval between the announcement of
the official totals and the end of the period during which recounts are
allowed, we must store all ballots for possible re-counting.
·
Therefore,
after counting, all ballots and all records from the polling place must be
placed in secure storage, under lock and seal. Not only the ballots that were
counted, but also spoiled ballots and ballots rejected during counting should
be saved. Not only the lists of voters who voted must be saved, but also all
ballot stubs, so that every ballot issued can be accounted for.
·
At the end
of the recount period, the stored ballots are typically destroyed, thus making
any attempt to initiate a recount outside the recount period moot.
This final requirement does not mean that the
candidate may not be impeached, subject to recall, or otherwise removed from
office, but rather, it removes such a removal from the domain of election law.
The election judges are constrained by the laws
and administrative rules imposed by the government. In the this presentation, a
number of suggested regulations are presented, but these are general procedural
rules. The one area where these rules are the least obvious and the most
critical to the outcome of the election where the rules govern the admissibility
of ballots and of individual votes on ballots.
One approach to this problem is to simply leave
ballot interpretation to the election judges. This approach is sometimes
classified as the "clear and obvious interpretation rule." Here, we
give the election judges the authority to interpret, as a vote, any mark on a
ballot which indicates the clear and obvious intent of a voter to cast a vote
for one or the other candidate.
The most obvious problem with this is that it
seems to give the judges a huge amount of leeway as to what marks they
interpret as votes, but by requiring that election judges work in pairs, where
each pair contains representatives of opposing parties, and by requiring that
observers be allowed to closely observe each pair of judges, clearly biased
judgements will be very difficult to hide.
A less obvious problem with this is that it allows
voters to "sign" their ballots by use of a distinctive marking
method. A voter could vote by initialing the box where a mark is intended, or a
voter could record a binary code using Xs and check marks to represent ones and
zeros, with one bit of data per office on the ballot (a long judicial retention
ballot would allow for thousands of distinct codes!).
·
To prevent
encoding of voter identity on a ballot, we typically require that votes be
indicated by some kind of standardized mark, for example, an X within a box of
standard dimensions provided beside each candidate name or yes/no alternative.
This standard is far stricter than the prohibition
of stray marks on the ballot that was suggested in the previous section. It can
be imposed in such a strict way that it becomes an effective tool for
conducting a very crooked election!
Consider a political machine or other entrenched
group desiring to preserve its power in the face of significant objections from
the electorate. One way to do this is to craft voting laws in such a way that
election judges have significant discretion as to which marks are acceptable as
votes and which can be disregarded or used to disqualify an entire ballot.
Of course, if the two opposing judges are equally
able to disqualify ballots, this poses little threat, but if the machine can
control who is hired as an election judge, a natural thing to do is to hire
carefully trained judges to work on behalf of the machine's party, while
selecting relatively inexperienced and untrained judges as representatives of
the opposition. Of course, if the opposition has the resources, they may
provide training to their judges, but in the traditional machine-run
metropolitan area, this has been a difficult venture.
A classical approach to enabling this kind of
election manipulation has been to enact complex laws (or administrative rules)
governing the acceptable forms of marks. For example, imagine a marking rule
that specified that the mark shall be in the form of an X made of straight
lines connecting opposite corners of the box beside the candidates name, with
no part of the X protruding outside the box -- such a protrusion being considered
a stray mark). A careful draftsman with a good eye may be able to make such a
mark, but most voters will only approximate it. Even so, fair-minded judges are
likely to ignore the fine details and accept minor deviations from this
standard until they learn how strict the machine's representatives are about
the slightest defects in marks for opposition candidates. By that time, a
sufficient number of votes may well have been counted to determine the
election!
The classical symptom of such manipulation is an
unusually high percentage of votes (or ballots) being excluded for improper
marking. The 1910 Encyclopedea Brittanica article on Voting Machines
mentions some elections in which such rules apparently led to the exclusion of
as many as 40% of the ballots cast in some elections, with exclusions being as
likely in well educated upper class precincts as they were in precincts with
large numbers of poor and illiterate people!
One way to prevent such absurd criteria is to
enumerate the acceptable types of marks, but in Coulehan v. White, a
case before the Maryland Supreme Court cited in the Encyclopedea Brittanica
article on Voting Machines, 27 different styles of X were enumerated. Requiring
that election judges be prepared to classify marks into such a complex scheme
almost guarantees that an entrenched machine will be able to prevale over a
weak opposition by ensuring that the machine's judges are better trained than
those representing the opposition.
To defend against this kind of legal attack on the
machinery of the election system, we may institute a mechanism such as the
following:
·
If one
election judge believes that a ballot contains a clear and obvious indication
of intent and the opposing judge with whom that judge is paired believes that
the ballot should be excluded because of an improper mark, because of an
overvote, or because of an undervote, the ballot should be set aside for
possible arbitration, in an envelope on the outside of which is noted which
vote (or votes) were subject to dispute and which judges were in dispute. The
procedural difficulty this imposes will generally discourage election judges
from disqualifying large numbers of votes!
·
The official
canvass must indicate not only the number of votes cast for each candidate, but
also the number of votes on behalf of each candidate excluded from the count
because of disagreements between the election judges over whether a mark is or
is not acceptable. It is natural and straightforward to include the count of
overvotes and undervotes in the canvass. Reporting everything guarantees that
any unfair practices during the vote count will be apparent in the final
figures.
·
If the
margin between the two leading candidates in an election exceeds the number of
disputed votes set aside on behalf of the second-place candidate, those ballots
must be reexamined. In extreme cases, such a reexamination might be done by a
jury in court, but it would seem prudent to do this only in extreme cases.
Normally, it is reasonable to hope that the difficulty would be resolved by a
different team of two election judges (representing opposing parties) or
perhaps by majority vote in a team of four (no two from the same party).
When ballot boxes are sealed prior to an election
at a central location, and when ballots are counted centrally after the polls
close, when ballots are moved to storage awaiting a request for recount, and
when ballots are moved from storage to the site of the recount, it is essential
that tampering be prevented.
Open transport of ballot boxes might be possible,
for example, if all ballots were moved in a bus along with a crowd of
observers, but generally, the cost of such a scheme outweighs any benefit. In
fact, if a crowd is allowed during transport, the turmoil of a moving crowd
could create new opportunities for fraud.
·
Therefore,
we typically require that all transport of ballots or ballot boxes be in the
custody of at least two election judges, representing opposing political
parties or campaigns, and that the judges travel together, in the same vehicle,
with the ballot box either in plain sight of all, for example, on the seat
between them, or with the ballot box locked away where nobody may touch it, for
example, in a locked trunk or locked in the rear of a van.
The requirements for ballot transfer are
comparable in some ways to the requirements for transfer of evidence in a
criminal case. Just as we are very concerned with the chain of custody for
evidence, from the policeman who observed it on the ground to the detective who
put it in a bag to the evidence storage locker where it was saved prior to the
trial, and finally to the person who delivered it to the courtroom, we are
equally concerned with the chain of custody for ballots.
In fact, the ballots are potential evidence in a
criminal trial! In the event that there is any allegation of tampering with the
election, the ballots become the central evidence about which the trial
revolves, and all of the steps in ballot processing become steps in the chain
of custody. This chain of custody must be documented.
·
At each
stage in ballot processing, a written record must be maintained indicating who
did what with the ballots. Who distributed them to voters, who sealed
transported the ballot box, who transported the ballot box, who counted the
ballots, and who saw to the locking and unlocking of the secure ballot storage
area. Each entry to this record is typically signed, witnessed and dated; where
possible, between signers and witnesses, opposing parties and interest groups
should be represented!
Secure ballot storage is essential, both between
the time ballots are printed and the time the polling place opens, and between
the time the votes are counted and the end of the recall interval. It is not
enough that they be stored under lock and key, since this requires that we
extend unlimited trust to all who have access to the key. Furthermore, all
locks are vulnerable to lockpicks!
·
Therefore,
we typically require that secure ballot storage be in an area that has multiple
high-quality locks, each with a different key, and we require that the keys for
these locks be in the custody of different officials, preferably representing
opposing factions.
·
We typically
require that locked entrance to the secure ballot storage area be visible to
the public and in an area that is regularly patroled by security personnel.
·
We typically
require that locked entrance to the secure ballot storage area be clearly
marked with easily visible and difficult to obscure warnings requiring that
witnesses be present whenever the door is open and whenever the locks are
manipulated in any way.