|
Q: What is a Voter-Verified Paper Trail (VVPT)?
A: Also known as a Voter-Verified Paper Audit Trail (VVPAT), this is a paper record of your vote, that you have verified is correct before it is stored in a lockbox. It is used to validate the results of an election and protect against computer problems and possible vote fraud.
Q: How is a VVPT different from a printout of the results from the computer?
A: Currently, only the contents of the memory of the computer is printed out when the polls close. You have no assurance with this printout that your vote was recorded properly by the computer in its memory. A VVPT ensures that even if the computer's memory is corrupted (whether by a bug or by tampering) your vote has been accurately recorded.
Q: What kinds of problems does a VVPT protect against?
A: Starting with the most likely:
- Computer failures - the software bugs and hardware failures that are an inevitable part of computer systems.
- Human error - the near certainty that someone unfamiliar with computers will make mistakes as a part of the voting process.
- Local vote tampering - a local election official or poll watcher trying to shift votes or digitally stuff the ballot box.
- Vote tampering at the manufacturer - a bribed programmer at the manufacturer introducing backdoor code that allows the election to be manipulated.*
- Outsider attacks against the computers - a skilled computer technician altering the election results.
*) While vote tampering at the manufacturer is fourth on the list in terms of likelihood, you should also be aware that this is the most dangerous scenario -- it can affect the greatest number of results and is the most difficult to protect against.
Q: If I can safely buy a book from Amazon on the Internet, why can't I trust an all-electronic voting system?
A: Recording votes is a much harder problem than conducting an e-commerce transaction. For an electronic voting system there are three conflicting requirements:
- The voter must be able to check that his or her vote was correctly recorded.
- Votes must be anonymous to anyone other than the voter.
- Election officials must be able to conduct an audit from original data.
Any two of these can be done relatively easily; all three together are very hard. In comparison, when buying a book from Amazon there is no requirement for anonymity -- in fact, you specifically don't want the buyer and seller to be anonymous.
Q: Weren't officials in Allegany County, MD able to conduct a recount?
A: No, they couldn't conduct a true recount. All they did was dump out the memory of the voting machines again. If there was a bug that prevented votes from being correctly recorded -- such as happened in Fairfax County, VA -- then they would be getting the same, incorrect result all over again.
Q: Doesn't using the computerized system remove the chance of human error from the system? Isn't requiring voter-verified paper ballots a step backwards?
A: No, the computerized system does not remove the chance of human error -- it just shifts the place where error could occur from the local election officials to the programmers of the system. No computer system of any reasonable size is free of bugs. Furthermore, finding bugs is a very hard task - the computer is not a magic wand.
All national leading academic computer security experts formally recommend a voter-verified paper audit trail for all computer voting systems. All three local professional in-depth reviews of the Maryland system have found major security flaws, and recommended a paper audit trail.
Q: Paper ballots have an error rate of up to 10% -- isn't the computer result more reliable?
A: The 10% error rate is for paper ballots filled in by hand. Since the paper trail will be computer-generated there should be little chance of a paper ballot being incorrectly filled out. Because the paper ballots will be used to audit the computer systems while the computers remain the primary method of reporting results, we would gain all of the advantages of a rapid tabulation as well as a solid audit check.
This is another version of the human error argument -- again, it just shifts the chance for human error from local elections officials and voters to the programmers, and programmer errors are harder to catch, potentially more catastrophic, and much more difficult to recover from.
As a point of reference, ask yourself the following questions:
- When was the last time you lost e-mail due to a computer problem?
- Who wrote the software that led to your e-mail being lost?
- Were you able to recover the e-mail?
- Would you trust a system that can lose things so easily to count your votes correctly?
Q: Don't paper ballots make it harder for people who are blind or visually handicapped to use the machines?
A: No, they don't make it any harder -- in fact, they make it more likely that the blind or visually handicapped will have their votes recorded correctly and anonymously. Blind or visually handicapped people will use the exact same machines that other voters will use. While they cannot visually verify their own paper ballots, if other, non-handicapped people are using the same machines then problems will be quickly identified. As it stands now, if there is a problem with one of the machines then no one will know about it -- neither the blind and visually handicapped nor the rest of the voters.
In the long run, it would be preferable to have some way for the blind and visually handicapped to check their own paper ballots, possibly through optical character recognition technology. However, the current form of voter verified paper trails does not make the blind and visually handicapped any worse off than they would be without it.
Q: There weren't any serious problems reported with these machines in the last election. Doesn't that mean that it's OK to use them?
A: Notice that there weren't any serious problems reported. In the Fairfax County, VA elections the fact that some votes were disappearing was noticed by a few keen-eyed voters. What if no one had noticed? What if there were in fact problems with the votes but no one happened to notice or there was no visible sign of a problem? We shouldn't be counting on keen-eyed voters to catch these kinds of problems.
Q: Aren't there anti-tampering measures already in place?
A: Some people have suggested that the TripWire software that has been recommended by RABA will prevent any chance of a problem. In fact, TripWire will not protect against either the most likely problem or the most dangerous problem.
TripWire works by creating a digital fingerprint of all of the software on the computer. If we compare the digital fingerprint before the election and after the election, then we know that no one has changed the software during the election.
The most likely problem is an inadvertent bug in the computer software -- either the election-specific software written by Diebold or the underlying operating system written by Microsoft. If the bug is there before the election, then it will be there after the election, and there will be no changes to the software during the election as a result of the bug. TripWire will not sound an alarm but the election results will still be incorrectly recorded.
The most dangerous problem is a corrupted programmer at Diebold. Again, the problem is in place before the software is loaded onto the election systems and no change will happen during the election. Again, TripWire will not sound an alarm but the election results will still be incorrectly recorded.
Q: Aren’t all of the machines thoroughly tested to make sure there are no problems?
A: Even the most extensive testing cannot uncover all of the problems in a computer system. For instance, in Georgia the Diebold machines froze after being in actual use for several hours, despite tests that subjected them to many more votes than were expected to be cast.
Furthermore, it is extremely easy for programmers to hide enormous chunks of code without being discovered. There is an entire flight simulator hidden in the Microsoft Excel 97 program! The Logic and Accuracy (L&A) tests that Diebold likes to tout are not aimed at finding such hidden code; in fact, no outside testing program could find it.
Q: Doesn't adding mechanical printers making the system less reliable? What happens if one of them jams?
A: High-reliability printing systems are mass-produced for use in point-of-sale systems such as cash registers. They are rated for thousands of hours without a jam.
Q: How are other states handling this question?
A: Some other states are already requiring paper audit trails, such as the state with the largest voter population, California. Many other states have bills before their legislature requiring voter-verified paper audit trails, or the executive branch of the state is requiring it on their own. The state with the longest history of using computer voting machines, New Hampshire, has required paper audit trails for years.
|
