1. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS 17-803/17-400 Electronic Voting Session 1: Introduction to Voting Michael I. Shamos, Ph.D., J.D. Institute for Software Research International Carnegie Mellon University

2. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Who Am I? Computerized voting system examiner for –Pennsylvania (1980-2000) –Texas (1987-2000) –West Virginia (1982) –Delaware (1989) –Nevada (1995) Examined over 100 different voting systems Testified before 3 Congressional committees and 4 state legislatures Member National Research Council eVoting Workshop, AAAS eVoting Workshop, SERVE Security Peer Review Group Expert witness in 3 electronic voting cases

3. Course Outline Introduction Paper Trail Systems Punched-Card Systems Optical Scan Voting Direct Recording Electronic (DRE) Voting The Diebold Reports Voting System Security Tabulation, Recounts & Contests The 2004 Election Cryptographic Methods Internet Voting Student Presentations

4. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Administrative Matters No textbook Readings, but no homework, no TA 12 sessions: lecture + group discussion Grading basis: –Student project (40%) –Final exam (40%) –Class participation (20%) Email: shamos@cs.cmu.edushamos@cs.cmu.edu Come see me: 4515 Newell Simon

5. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS History of Voting “Ballots” from Italian ballotta, meaning “little ball” Ancient: clash of spears, balls in urns, division by groups, wooden tickets (tabellæ) American colonies: voting aloud to public official 1857: Australia introduces secret paper ballot 1888: Australian ballot introduced in U.S. (KY, MA) 1892: Mechanical lever machine to “protect mechanically the voter from rascaldom” 1960s: Punched cards 1970s: Optical scan 1978: Direct-recording electronic systems 2000: Internet voting in primaries

6. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Constitutional Basis “The House of Representatives shall be composed of Members chosen every second Year by the People of the several States.” U.S. Const. Art I, §2Art I, §2 “But when the right to vote at any election for the choice of electors for President and Vice President of the United States, Representatives in Congress, the Executive and Judicial officers of a State, or the members of the Legislature thereof, is denied to any of the male inhabitants of such State, being twenty-one years of age, and citizens of the United States, or in any way abridged, except for participation in rebellion, or other crime, the basis of representation therein shall be reduced in the proportion which the number of such male citizens shall bear to the whole number of male citizens twenty-one years of age in such State. 14 th Amend. (1868)14 th Amend

7. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Constitutional Basis “The right of citizens of the United States to vote shall not be denied or abridged by the United States or by any State on account of race, color, or previous condition of servitude.” U.S. Const. 15 th Amend. (1870)15 th Amend “The Senate of the United States shall be composed of two Senators from each State, elected by the people thereof, for six years” 17 th Amend. (1913)17 th Amend “The right of citizens of the United States to vote shall not be denied or abridged by the United States or by any State on account of sex.” 19 th Amend. (1920)19 th Amend

8. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Constitutional Basis The right of citizens of the United States to vote in any primary or other election for President or Vice President, for electors for President or Vice President, or for Senator or Representative in Congress, shall not be denied or abridged by the United States or any State by reason of failure to pay any poll tax or other tax.” 24 th Amend. (1964) 24 th Amend The right of citizens of the United States, who are eighteen years of age or older, to vote shall not be denied or abridged by the United States or by any State on account of age. 26 th Amend. (1971)26 th Amend The Times, Places and Manner of holding Elections for Senators and Representatives, shall be prescribed in each State by the Legislature thereof; but the Congress may at any time by Law make or alter such Regulations, except as to the Places of chusing Senators. Art. I, §4.Art. I, §4

9. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Voting Jurisdictions Voting in the U.S. is conducted by the states –50 states + DC + territories –Supervised generally by Secretaries of State –Delegated to 3170 counties ~10,000 voting jurisdictions (cities, school boards, …) ~200,000 precincts (avg. 60-70 per county) > 1,400,000 poll workers (avg. 7/precinct, 440/cty) 150 million registered voters, 105 million actually vote Federal government has very little power over elections

10. PENNSYLVANIA

11. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Pennsylvania Voting Methods 2004 Optical Punch Card Lever DRE Paper Mixed N/A SOURCE: ELECTIONLINE.ORGELECTIONLINE.ORG ALLEGHENY COUNTY

12. Allegheny County CITY OF PITTSBURGH

13. 5 th Ave. (Precincts)

14. Pittsburgh East End Wards and Precincts 14 th City Ward 5 th Ave.

15. Pittsburgh East End Political Districts 8 th City Council District

16. Pittsburgh East End Political Districts 11 th County Council District

17. Pittsburgh East End Political Districts 23 rd Pennsylvania House District

18. Pittsburgh East End Political Districts 43 rd Pennsylvania Senate District

19. Pittsburgh East End Political Districts 43 rd Senate23 rd House 8 th City Council11 th County Council

20. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Generic Election Org Chart CHIEF ELECTION OFFICER (SECRETARY OF STATE) STATE BOARD OF ELECTIONS STATE BOARD OF CANVASSERS STATE CHIEF COUNTY ELECTION OFFICER COUNTY BOARD OF ELECTIONS COUNTY BOARD OF CANVASSERS COUNTY PRECINCT ELECTION JUDGE POLL WORKERS INSPECTORS LOCAL WATCHERS

21. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Voting Issues Straight-party voting Vote-for-many Overvotes Undervotes Write-in votes (declared, undeclared) Early voting Absentee voting Alternative (disabled) voting

22. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Voting Issues Challenged voters, provisional ballots Spoiled ballots Invalid ballots Disabled access, e.g. audio ballots Ballot rotation Language requirements

23. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Authentication In each precinct, only registered voters are allowed to vote Need a registration system before the election Need authentication mechanism on Election Day –Only registered voters vote –No one can impersonate a voter –Each voter can only vote once In this course, we will not discuss voter registration

24. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Paper (0.6%) Ridiculous! –Requires manual counting –Easy fraud –Ballot stuffing –Invalidation SOURCE: TOMPKINS COUNTY, NYTOMPKINS COUNTY, NY X OVERVOTE CANCELS VOTE FOR MAYOR

25. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Lever Machines (14%) SOURCE: MICHIGAN SOSMICHIGAN SOS

26. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Lever Machines (14%)

27. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Lever Machines (14%)

28. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Punched-Card (14%)

29. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Mark Sense, Optical Scan (34%) TIMING MARKS START OF BALLOT

30. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Mark-Sense, Optical Scan (34%) Scanning methods –Visible light –Infrared Issues: –Dark/light marks –Some scanners require carbon-based ink –Voter intent may not be captured by machine Machine does not see what the human sees

31. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Direct-Recording Electronic (31%) SOURCE: SHOUP VOTING SOLUTIONSSHOUP VOTING SOLUTIONS DEMO

32. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Direct-Recording Electronic (31%) SOURCE: SHOUP VOTING SOLUTIONSSHOUP VOTING SOLUTIONS

33. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS U.S. Voting Methods 2000-2004 Punched-card (32%) Optical scan (28%) Lever (16%) DRE (12%) Paper (1%) Indeterminate: (11%) PUNCHED CARD OPTICAL LEVER DRE ? 2000 PAPER Optical scan (34%) DRE (31%) Lever (14%) Punched-card (14%) Paper (1%) Indeterminate: (6%) DRE CARD OPTICAL LEVER ? 2004

34. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Balloting Methods 2004 Paper (<1%) Mechanical lever voting machine (14%) Punched-card (14%) Mark-sense (34%) Direct-recording electronic (DRE) (31%) Indeterminate (6%) SOURCE: FEC.GOVFEC.GOV

35. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Ballot Types Document ballot –Paper ballot –punched-card –optical scan Non-document ballot –Lever machine –DRE machine

36. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Functions of a Voting System 1. Authenticate voter 2. Present candidates and issues to voter 3. Capture voter’s preferences 4. Transport preferences to counting location 5. Add up vote totals (tabulation) 6. Publish vote totals (reporting) 7. Provide audit mechanism But: vote must be secret CS ISSUES SECURITY PRIVACY HCI SOFTWARE ENGINEERING

37. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Voting System Requirements Secrecy Security Accuracy Auditability Accessibility to disabled Protective counter (votes cast since manufacture) Public counter (votes cast today) Conform to state voting provisions (e.g. write-ins) Meet Federal standards

38. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Qualification/Certification The Federal Election Commission (FEC) published voluntary standards for voting systemsstandards Many states have made the standards mandatory How to test against them? The National Association of State Election Directors (NASED) has authorized a small number of Independent testing authorities to qualify voting systemsNASED After qualification, most states have a certification process to verify that the system satisfies state law

39. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Qualification/Certification Problems The FEC standards are inadequate for software security The ITAs operate in secret –Don’t publish their testing protocols –Don’t publish their findings, just whether a system passed The ITAs are paid by the vendors State certifications are cursory, usually not performed by experts

40. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Help America Vote Act of 2002 Payments to states to replace paper and level machines: $3 billion Establishes Election Assistance CommissionElection Assistance Commission Reforms the standards process (National Institute of Standards and Technology)National Institute of Standards and Technology Provisional voting Statewide registration systems Complaint procedure

41. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Student Projects Internet voting review Verifiability without paper Voter privacy assessment Code hiding –Can code be hidden undetectably? Alternative voting systems –ATM, lottery Secure software distribution –Assure that software inside voting machines is genuine Voting security standards –What should they look like?

42. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Q A &

43. Outline Evolution of Voting PAPER BALLOTS - 1960 PUNCHED CARDS ~ 1960 MARK SENSE ~ 1970 DRE ~ 1980 PAPER TRAILS ~ 2004

44. New York Times, April 4, 1855 BALLOT BOXES DESTROYED INJURIES IN RIOTS MORE BALLOTS CAST THAN NAMES ON THE POLL LIST

45. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Florida’s Solution “The ballots shall first be counted, and, if the number of ballots exceeds the number of persons who voted … the ballots shall be placed back into the box, and one of the inspectors shall publicly draw out and destroy unopened as many ballots as are equal to such excess.” F.S. §102.061F.S. §102.061

46. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Classical Voting Fraud Since 1851, the New York Times has published 4,744 articles on non-electronic voting fraud One every 12 DAYS for the past 150 years! The articles describe over 800 actual frauds One every 68 DAYS for the past 150 years

47. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Paper Trail Proposal Allow each voter to see her choices on paper before casting a vote If the choices are incorrect, they can be corrected The paper becomes the official ballot If there is a discrepancy between the paper record and the computer record, the paper governs Why? Because that’s the one the voter verified It all sounds logical, but isn’t

48. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Paper Trail Advantages Demonstrates to the voter that the machine captured her choices correctly Creates a sense of security among voters

49. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Paper Trail Disadvantages No guarantee vote was counted, will ever be counted or paper will be in existence if a recount is ordered Massive paper handling and security problem Slow counting –Sacramento experiment 06/04: took an average of 20 minutes per ballot to tabulate and verify results –Recounting California would take 450 years Accessibility issues Voter confusion –Must remember a lengthy ballot Machines questioned when nothing is wrong Increased demand for recounts Creates doubt among voters (CalTech-MIT Report)

50. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Voting Problems Machine won’t operate Machine fails during the election Intruder tampers with paper records –Stuffing, removal, alteration Machine captures choices incorrectly Intruder alters vote totals after election Machine maliciously or erroneously switches votes NOT ADDRESSED BY PAPER TRAIL SOLVED BY PAPER TRAIL DEPENDS ON PHYSICAL SECURITY OF PAPER TRAIL

51. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Avante Vote-Trakker Paper Trail NJ021111002026 482961 Feb 26, 2001 President / Vice President GEORGE WASHINGTON, Andrew JACKSON US Senator John HANCOCK House of Representative Ben Franklin County Clerk JohnQuincy ADAMS Board of Chosen Freeholders Paul REVERE Board of Chosen Freeholders William HTAFT Board of Chosen Freeholders Theodore ROOSEVELT Public Question 1 Yes Public Question 2 No Public Question 3 Yes Thank you for voting! SOURCE: AVANTE

53. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Counting Punched Cards SOURCE: LOS ANGELES COUNTY

54. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS What’s an Audit Trail? Two types: –A. Record of voting system events, e.g. opening of polls –B. Record of ballot images In Maryland, a voting system must be “be capable of creating a paper record of all votes cast in order that an audit trail is available in the event of a recount.” Md. Election Law § 9-102(c)(1)(vi) Md. Election Law § 9-102(c)(1)(vi) This is done by storing complete ballot images in randomized order

55. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS What’s a Recount? Purpose: “verify” that the original tabulation was correct Three kinds of recounts: –A. Physical ballots exist: Count them again. –B. Computer records exist: Tabulate them again. –C. No physical ballots or computer records exist (e.g. lever machines): Read the counters again

56. Adams 34 Allegheny 2 Armstrong 38 Beaver 19 Berks 10 Bedford 43 Cambria 21 Clearfield 36 Clinton 57 Huntingdon 45 Blair 26 Bradford 40 Bucks 4 Butler 20 Cameron 66 Carbon 41 Centre 24 Chester 7 Clarion 52 Columbia 39 Crawford 35 Cumberland 17 Dauphin 15 Delaware 5 Elk 59 Erie 13 Fayette 23 Forest 67 Fulton 64 Greene 54 Indiana 33 Jefferson 46 Juniata 61 Lackawanna 16 Lancaster 6 Lawrence 32 Lebanon 30 Lehigh 12 Luzerne 11 Lycoming 29 McKean 47 Mercer 28 Mifflin 48 Monroe 25 Montgomery 3 Montour 62 Northampton 14 Northumberland 31 Perry53 Philadelphia 1 Pike 49 Potter 63 Schuylkill 22 Snyder 58 Somerset 37 Sullivan 65 Susquehanna 56 Tioga 55 Union 51 Venango 42 Warren 50 Washington 18 Wayne 44 Westmoreland 8 Wyoming 60 York 9 Franklin 27 LVM DRE Punch Card Optical Scan LVM/Paper DRE/Paper Pennsylvania Voting Methods County Name Rank by # of Voters SOURCE: DAVID CASEY

57. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Lever Machines (14%) SOURCE: POLITICSNJ.COMPOLITICSNJ.COM

58. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Votomatic Punched-Card System VOTING BOOTH BALLOT FRAME VOTING STYLUS BALLOT SEALS VOTING SETUP

59. 17-803/17-400 ELECTRONIC VOTING FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Punched Card (14%) CHAD POSITIONS 4, 20, 60, 82, 117 ARE PUNCHED NO CANDIDATE NAMES ON CARD STUB FOR WRITE-INS REGISTRATION HOLES HOLES NOT ALWAYS RECTANGULAR