U.S. jurisdictions using electronic voting systems this November would do well to implement routine post-election auditing and press for open-source software to help ensure fair votes in the future, said e-voting experts at the Technology Review EmTech conference on Thursday.
California Secretary of State Debra Bowen said that her state's review of touch-screen voting systems known as DREs (direct-recording electronic) found that they all had problems, starting with physical security vulnerabilities. Roughly 30 percent of voters nationwide are expected to cast their ballots on DREs in November, according to Verified Voting Foundation President Pamela Smith, who joined Bowen and others in a panel discussion. The foundation advocates for paper trails to be used in conjunction with DREs.
Bowen, who has been in the forefront of state officials seeking to ensure that voting machines are secure and accurate, called for voting machine vendors to move to open-source software. Currently, the software that runs the systems is proprietary and closely held by the vendors, and nondisclosure agreements prevent the code from being scrutinized for bugs and security flaws more broadly, she said.
Massachusetts Institute of Technology computer science professor Ronald Rivest, however, asked, "Do you have to trust the software?" He suggested that another goal to strive for is software independence, where neither malware nor a bug could change the results of an election. The way to accomplish this is verifiability, and the panelists seemed to agree on the need for election officials to routinely conduct limited but statistically significant post-election audits.
Audits are useful not only to verify the reliability of the voting equipment, but also to help with larger process issues, said Doug Chapin, director of the Pew Center on the States electionline.org project, a nonpartisan Web site. Audits can identify problems as basic as inadequate poll-worker training, he added.
In an interview later, Smith said she wanted to remind election officials that the audit happens after the election, and there is still time to plan for a pilot audit even if you haven't done one before.
"If you've got paper, use it, demonstrate that your system works," she said. "Randomly select precincts, randomly select a few contests and manually count them. Invite in some observers. It's not hard to do."
Only 8 percent to 10 percent of the DRE systems that will be used in the presidential election are equipped with voter-verified, paper-audit-trail printers, Smith said. She noted that DRE systems will be less widely used in the 2008 election than they were in 2006, when about 39 percent of voters cast their ballots on touch screens. Her organization maintains an online map that allows individuals to see how votes will be cast in their local area.
ElectionAudits.org has published a set of best practices and principles that election officials can use to plan an audit, Smith said.