Vviewpoints

DOI: 10.1145/1400181.1400192

Point/Counterpoint
The U.S. Should Ban Paperless
Electronic Voting Machines

Debating the public policy issues involved in proposed efforts toward improving voting systems while considering the range of technical and societal challenges.

Point: David L. Dill

WHEN u.S. VOTERS go the polls next month, it will be impossible to determine whether the victorious candidates in many states were elected by a software bug, a virus in the voting system, the voting system programmers, or the voters themselves. Those states have voting machines that rely entirely on electronic ballots (these machines are referred to as direct-re-cording electronic voting machines, or DREs). There is no way to tell whether the votes recorded by DRE machines match those selected by the voters.

The solution is straightforward: Ban the use of untrustworthy paperless DREs, and demand that readily available systems that are auditable, accurate, reliable, accessible, and cost-effective be used in their place.

PHO TOGRAPH BY MARIO TAMA

Paperless electronic voting is unworkable in principle with current technology. It is based on the mistaken idea that we can build computers that can be trusted to carry out operations whose results cannot be independently verified. But that’s a practically impossible problem to solve, even given our best efforts. There is no way to know whether any of the many people involved in the design, implementation, and manufacture of the machines made a mistake or introduced a malicious change. If that were to happen, enough votes could be corrupted to

change the outcomes of many elections—invisibly. This fact raises questions about all elections utilizing paperless DREs. Even if the machines are counting votes perfectly, we have no way of confirming that.

Why are paperless DREs more risky than the computers we rely on for banking, medical equipment, and flight software? It’s because there is independent verification of the results of operating these other systems. If your plane lands in the wrong city or crashes, or your pacemaker malfunctions, either you or your survivors know about it. If banking software makes an error, you can check your statements to find it. But paperless DREs have no independent verification. If votes are changed in a plausible way, how will anyone ever know?

year. Security reviews in California^a and more recently in Ohio^b documented breathtaking blunders in the security designs of the most widely used DRE systems in the U.S, which collectively process millions of votes. In each case, a single person with limited access could introduce a virus into the system during one election that could take over all the voting systems in the jurisdiction in the next election.^c

It is urgently necessary to ban cur-

 

In reality, current DREs are not even close to “best efforts,” as has been shown repeatedly, especially in the last

a M. Bishop, “Overview of Red Team Reports,” Top-to-Bottom Review, California Secretary of State’s Office; www.sos.ca.gov/elections/vot-ing_systems/ttbr/red_overview.pdf.

b A press release on the EVEREST study of voting equipment security for the Ohio Secretary of State is available at www. sos.state.oh.us/SOS/ PressReleases/2007. Detailed reports are available at www. sos.state.oh.us/SOS/elections/vot-erInformation/equipment/.

c There is a video of team at Princeton showing several ways to hack the Diebold AccuVote-TS DRE at youtube.com/watch?v=aZws98jw67g.